Found 847 bookmarks
Custom sorting
Hundreds of Swedish municipalities impacted by suspected ransomware attack on IT supplier
Hundreds of Swedish municipalities impacted by suspected ransomware attack on IT supplier
therecord.media Alexander Martin August 27th, 2025 A suspected ransomware attack on a Swedish software provider is believed to have impacted around 200 of the country’s municipal governments. A suspected ransomware attack on Miljödata, a Swedish software provider used for managing sick leave and similar HR reports, is believed to have impacted around 200 of the country’s municipal governments. The attack was detected on Saturday, according to the company’s chief executive Erik Hallén. The attackers are attempting to extort Miljödata, police told local newspaper BLT. Swedish Minister for Civil Defence Carl-Oskar Bohlin wrote in a short update on social media: “The scope of the incident has not yet been clarified, and it is too early to determine the actual consequences.” Hallén told Swedish press agency TT that around 200 municipalities and regions were affected by the incident. Sweden has 290 municipalities and 21 regions. Several regional governments have confirmed using Miljödata systems to handle employee data, including “for example, medical certificates, rehabilitation plans, work-related injuries, and more,” according to the local government of the island of Gotland. Hallén reportedly said Miljödata was “working very intensively with external experts to investigate what happened, what and who was affected, and to restore system functionality.” “The government is receiving ongoing information about the incident and is in close contact with the relevant authorities,” Bohlin, the civil defense minister, said. “CERT-SE, which has the task of supporting Swedish society in handling and preventing IT security incidents, has offered advice and support to both the company in question and the affected customers,” the minister added. “The national cybersecurity center is coordinating the measures of the relevant authorities. A police investigation is also underway.” He stressed the incident underscored the need for high levels of cybersecurity throughout society, and said the Swedish government planned to present a new cybersecurity bill to the Swedish parliament in the near future “that will impose increased requirements on a wide range of actors.”
#therecord.media#EN#2025#Miljödata#Sweden#ransomware#municipalities
·therecord.media·
Hundreds of Swedish municipalities impacted by suspected ransomware attack on IT supplier
Thousands of Developer Credentials Stolen in macOS “s1ngularity” Attack
Thousands of Developer Credentials Stolen in macOS “s1ngularity” Attack
https://hackread.com by Deeba Ahmed August 28, 2025 A supply chain attack called “s1ngularity” on Nx versions 20.9.0-21.8.0 stole thousands of macOS developer credentials with the help of AI tools. Asophisticated cyberattack, dubbed the “s1ngularity” attack, has compromised Nx, a popular build platform widely used by software developers. The attack, which began on August 26, 2025, is a supply chain attack, a type of security breach where hackers sneak malicious code into a widely used piece of software, which then infects all the people who use it. The attack was designed to steal a wide variety of sensitive data, including GitHub tokens, npm authentication keys, and SSH private keys. These credentials are essentially digital keys that provide access to a user’s accounts and systems. The malicious software also went a step further, targeting API keys for popular AI tools like Gemini, Claude, and Q, demonstrating a new focus on emerging technologies. In addition to stealing data, the attackers installed a destructive payload that modified users’ terminal startup files, causing their terminal sessions to crash. GitGuardian’s analysis shared with Hackread.com revealed some surprising details about the attack and its victims. The firm found that 85% of the infected systems were running macOS, highlighting the attack’s particular impact on the developer community, which frequently uses Apple computers. In a curious turn, GitGuardian found that of the hundreds of systems where AI tools were targeted, many of the AI clients unexpectedly resisted the malicious requests. They either outright refused to run the commands or gave responses suggesting they knew they were being asked to do something wrong, showing a potential, though unintentional, new layer of security. The stolen credentials were not only valuable but also widespread. GitGuardian’s monitoring platform, which tracks public GitHub activity, discovered 1,346 repositories used by the attackers to store stolen data. To avoid detection, the attackers double-encoded the stolen data before uploading it. This number is far higher than the ten publicly visible repositories, as GitHub was quickly working to delete the rest. An analysis of these repositories revealed 2,349 distinct secrets, with over 1,000 still valid and working at the time of the report. The most common secrets were for GitHub and popular AI platforms. For anyone who used the malicious Nx versions 20.9.0 through 21.8.0, the most crucial step is to immediately assume that their credentials have been exposed. GitGuardian has created a free service called HasMySecretLeaked that allows developers to check for compromised credentials without ever revealing their actual keys. This attack reminds us that simply deleting a compromised file is not enough; the actual secret keys and tokens must be revoked and rotated to prevent further access by the attackers.
#hackread.com#EN#2025#Nx#Supply-Chain-Attack#npm#s1ngularity
·hackread.com·
Thousands of Developer Credentials Stolen in macOS “s1ngularity” Attack
Swiss hospitals join forces against cyber-attacks - SWI swissinfo.ch
Swiss hospitals join forces against cyber-attacks - SWI swissinfo.ch
www.swissinfo.ch August 28, 2025 - Swiss health groups found national cyber-security centre to warn against cyber attacks. The cantonal hospital authorities of Ticino and Graubünden are among the founders of the Healthcare Cyber Security Centre (H-CSC). The premise is that “hospitals are tempting targets for cybercriminals, since they handle large quantities of sensitive data,” said H-CSC as it was officially established in Thurgau. The initiative in Ticino was also joined by the Gruppo ospedaliero Moncucco, which brings together the Moncucco clinics in Lugano and Santa Chiara in Locarno, and a Graubünden foundation made up of health care associations, including the Thusis hospital. Founding members also include the university hospitals of Basel, Bern and Zurich, but not in Geneva and Lausanne. French-speaking institutions are clearly under-represented – the Fribourg and Valais hospitals are the only members from this region. But H-CSC is set to grow. “Membership of the association will be open from 1 September 2025 to all hospitals with a public service mandate”. The H-CSC project was launched last year on the recommendation of the Federal Office for Cyber Security. The aim of the association is to offer tailor-made security services for hospitals in the field of cyber security. The H-CSC (https://www.h-csc.ch/) will serve as a platform to promote knowledge exchange and collaboration between hospitals, expand existing competencies and create synergies that will “sustainably strengthen their ability to prevent, detect and contain cyber incidents”, the association’s website states. Such incidents can “severely compromise the functioning (of hospitals), causing the postponement of surgeries, encryption and/or disclosure of sensitive patient data, or the inoperability of medical devices.”
#www.swissinfo.ch#EN#2025#Switzerland#H-CSC#project#health#alliance#hospitals
·swissinfo.ch·
Swiss hospitals join forces against cyber-attacks - SWI swissinfo.ch
Euro banks block 'unauthorized' PayPal direct debits
Euro banks block 'unauthorized' PayPal direct debits
www.theregister.com 2025/08/28/ - US payments platform back in action, says it's informing affected customers Shoppers and merchants in Germany found themselves dealing with billions of euros in frozen transactions this week, thanks to an apparent failure in PayPal's fraud-detection systems. According to the Association of German Banks, the problem hit on Monday when banks noticed a slew of recent unauthorized direct debits from PayPal. The body said the banks responded in various ways, which is one way of putting it – the Süddeutsche Zeitung reported that some stopped all PayPal transactions, with the total number of frozen payments likely to be around €10 billion. A spokesperson for the German Savings Banks Association (DSGV), which represents hundreds of regional banks across the country, confirmed the issue to The Register. The DSGV said PayPal had assured it the problem was resolved, adding that PayPal payments had been running smoothly since Tuesday morning and the US payments platform was informing affected customers "directly." The DSGV said the unauthorized payments had a "significant impact on transactions throughout Europe, particularly in Germany." However, there have been no confirmed reports of the incident being felt outside Germany. Austrian media reported that the banks there had seen no problems. PayPal is the most popular method of online payment in Germany, having been used for 28.5 percent of online purchases last year, according to research by the EHI Retail Institute. (The next most popular option is buying on account.) That's largely down to PayPal's payment protection, which appeals to privacy-conscious Germans. In the wake of the unauthorized direct debit issue, financial industry consultant Peter Woeste Christensen told local media that PayPal's particular strength in Germany was partly thanks to the poor user experience of German banks' own apps. PayPal had not responded to The Register's request for comment at the time of publication, although SZ quoted a spokesperson as saying PayPal had quickly identified the cause and was working with banks to "ensure all accounts are updated." The US company referred to the incident as a "temporary service interruption." PayPal's reputational hit in Germany is likely to be exacerbated by last week's reports of hackers offering millions of PayPal credentials that they claimed PayPal had recently exposed in plaintext. The hackers' claims appear dubious, with PayPal denying any recent breach, but the reports gained significant traction in Germany. "It's possible that the data is incorrect or outdated," read a Wednesday advisory from the German consumer organization Stiftung Warentest, which bundled the leak report with this week's snafu. "Nonetheless, PayPal users should change their passwords as a precaution."
#theregister.com#EN#2025#PayPal#fraud#direct#debits#precaution#Germany
·theregister.com·
Euro banks block 'unauthorized' PayPal direct debits
Intelligence Brief: UNC6040 Threat Assessment
Intelligence Brief: UNC6040 Threat Assessment
cstromblad.com Christoffer Strömblad Wednesday, August 27, 2025 - In this multi-source analysis I’ve attempted to fuse publicly available information about the UNC6040 group into one report and analysis to provide a better view of the activity cluster named UNC6040 (Google/Mandiant naming). Executive Summary UNC6040 represents a sophisticated financially motivated threat group that has emerged as a significant threat to organizations utilizing cloud-based customer relationship management systems. First identified by Google’s Threat Intelligence Group1, this actor has been conducting voice phishing campaigns since at least December 20242 to compromise Salesforce environments for large-scale data theft and extortion purposes. The group has successfully breached approximately 20 organizations across hospitality, retail, and education sectors3, demonstrating a clear preference for targets with substantial customer databases and valuable personally identifiable information. Perhaps most notably, the group successfully compromised Google’s own Salesforce environment through sophisticated OAuth token abuse4, highlighting their capability to breach even well-defended organizations. What distinguishes UNC6040 from traditional threat actors is their primary reliance on social engineering rather than technical exploitation. By impersonating IT support personnel through voice calls, they guide victims to authorize malicious connected apps, specifically modified versions of Salesforce’s Data Loader tool1. This approach effectively bypasses traditional security controls including multi-factor authentication, representing a fundamental shift in the threat landscape that security teams must address. Threat Actor Profile and Victimology UNC6040’s targeting reveals a calculated approach to victim selection. The group primarily focuses on luxury retailers, hospitality organizations, and educational institutions3, with additional confirmed targeting of aviation, financial services, and technology companies2. This sector preference suggests a clear understanding of where high-value customer data concentrates and where cloud CRM adoption is mature. The threat actor demonstrates varying levels of technical proficiency across different intrusions, with some operations achieving complete data extraction while others result in only partial exfiltration before detection1. This inconsistency may indicate either multiple operators with different skill levels or an evolving tradecraft as the group refines their techniques. Intelligence suggests potential collaboration with other threat actors, particularly the ShinyHunters collective4. UNC6040 may engage in partnership models where initial compromise and data theft are followed by collaboration with specialized extortion groups months after the initial breach1. This delayed monetization strategy complicates attribution and incident response efforts. Operational Capabilities and Techniques The group’s attack methodology begins with extensive reconnaissance through automated phone systems and live calls where operators impersonate IT support staff53. This initial intelligence gathering phase allows them to understand organizational structures, identify key personnel, and develop credible pretexts for their social engineering approaches. The technical implementation involves guiding victims to Salesforce’s connected app setup page where they authorize malicious applications using connection codes1. These modified Data Loader applications are often disguised with legitimate-sounding names such as “My Ticket Portal” to align with the social engineering narrative13. Once authorized, these applications provide API-level access enabling bulk data exfiltration through legitimate platform features. Post-compromise activities extend beyond the initial Salesforce environment. The group demonstrates capability for lateral movement, targeting Okta, Microsoft 365, and Workplace environments to harvest additional credentials and expand their access32. They employ test queries before conducting full data extraction1, suggesting a methodical approach to validating access and identifying high-value datasets. The group’s data exfiltration focuses on customer PII including names, dates of birth, addresses, phone numbers, and account metadata2. By avoiding custom malware and instead relying on legitimate tools and platform features, they maintain a minimal forensic footprint that complicates detection and attribution efforts2. Infrastructure and Operational Security UNC6040 demonstrates strong operational security practices, primarily accessing victim environments through Mullvad VPN IP addresses1. This VPN usage provides anonymity and complicates law enforcement efforts to track the group’s activities. The threat actors also utilize Okta phishing panels hosted on the same infrastructure as their vishing operations1, suggesting a centralized approach to their technical infrastructure. The group’s infrastructure choices reflect an understanding of modern detection capabilities and a deliberate effort to blend malicious activity with legitimate traffic patterns. By leveraging standard Salesforce API calls and OAuth workflows4, they avoid triggering traditional security alerts focused on malware or anomalous network traffic. Strategic Outlook and Future Developments The success of UNC6040’s operations, including the high-profile breach of Google’s Salesforce environment4, will likely inspire both evolution of their own tactics and adoption of similar techniques by other threat actors. In the near term, we assess with moderate confidence that the group will expand their targeting to additional cloud CRM platforms as organizations increase security awareness around Salesforce-specific threats. The demonstrated collaboration between UNC6040 and groups like ShinyHunters4 suggests a maturing criminal ecosystem where specialized actors collaborate to maximize the value extracted from compromised organizations. This partnership model is likely to expand, with UNC6040 potentially serving as an initial access broker for ransomware operations or other extortion groups. The fundamental challenge posed by UNC6040 lies not in their technical sophistication but in their exploitation of human trust and legitimate platform features. As organizations implement phishing-resistant MFA and enhanced monitoring capabilities5, the group will likely evolve their social engineering tactics and potentially shift toward supply chain targeting through managed service providers and cloud service integrators. Looking forward, the convergence of voice-based social engineering with OAuth abuse and API-level data access represents a maturation of the threat landscape that traditional perimeter-based security models are poorly equipped to address. Organizations must anticipate continued activity from UNC6040 and similar groups, with potential escalation in both the scale of operations and the sophistication of social engineering techniques employed. The shift from technical exploitation to identity-based attacks demonstrated by UNC6040 requires a fundamental reconsideration of security architectures. As legitimate platform features become the primary vector for data exfiltration, the distinction between authorized and malicious activity becomes increasingly nuanced, demanding behavioral analytics and continuous monitoring capabilities that many organizations currently lack. https://cloud.google.com/blog/topics/threat-intelligence/voice-phishing-data-extortion/ ↩︎ ↩︎ ↩︎ ↩︎ ↩︎ ↩︎ ↩︎ ↩︎ ↩︎ https://unit42.paloaltonetworks.com/retail-hospitality-heists-in-the-digital-age/ ↩︎ ↩︎ ↩︎ ↩︎ ↩︎ https://www.varonis.com/blog/salesforce-vishing-threat-unc604 ↩︎ ↩︎ ↩︎ ↩︎ ↩︎ https://guardz.com/blog/from-vishing-to-oauth-abuse-how-shinyhunters-compromised-the-cloud/ ↩︎ ↩︎ ↩︎ ↩︎ ↩︎ https://cloud.google.com/blog/topics/threat-intelligence/technical-analysis-vishing-threats/ ↩︎ ↩︎
#cstromblad.com#EN#2025#UNC6040#threat-actor#Salesforce
·cstromblad.com·
Intelligence Brief: UNC6040 Threat Assessment
Agentic Browser Security: Indirect Prompt Injection in Perplexity Comet
Agentic Browser Security: Indirect Prompt Injection in Perplexity Comet
brave.com blog Published Aug 20, 2025 - The attack we developed shows that traditional Web security assumptions don't hold for agentic AI, and that we need new security and privacy architectures for agentic browsing. The threat of instruction injection At Brave, we’re developing the ability for our in-browser AI assistant Leo to browse the Web on your behalf, acting as your agent. Instead of just asking “Summarize what this page says about London flights”, you can command: “Book me a flight to London next Friday.” The AI doesn’t just read, it browses and completes transactions autonomously. This will significantly expand Leo’s capabilities while preserving Brave’s privacy guarantees and maintaining robust security guardrails to protect your data and browsing sessions. This kind of agentic browsing is incredibly powerful, but it also presents significant security and privacy challenges. As users grow comfortable with AI browsers and begin trusting them with sensitive data in logged in sessions—such as banking, healthcare, and other critical websites—the risks multiply. What if the model hallucinates and performs actions you didn’t request? Or worse, what if a benign-looking website or a comment left on a social media site could steal your login credentials or other sensitive data by adding invisible instructions for the AI assistant? To compare our implementation with others, we examined several existing solutions, such as Nanobrowser and Perplexity’s Comet. While looking at Comet, we discovered vulnerabilities which we reported to Perplexity, and which underline the security challenges faced by agentic AI implementations in browsers. The attack demonstrates how easy it is to manipulate AI assistants into performing actions that were prevented by long-standing Web security techniques, and how users need new security and privacy protections in agentic browsers. The vulnerability we’re discussing in this post lies in how Comet processes webpage content: when users ask it to “Summarize this webpage,” Comet feeds a part of the webpage directly to its LLM without distinguishing between the user’s instructions and untrusted content from the webpage. This allows attackers to embed indirect prompt injection payloads that the AI will execute as commands. For instance, an attacker could gain access to a user’s emails from a prepared piece of text in a page in another tab. How the attack works Setup: An attacker embeds malicious instructions in Web content through various methods. On websites they control, attackers might hide instructions using white text on white backgrounds, HTML comments, or other invisible elements. Alternatively, they may inject malicious prompts into user-generated content on social media platforms such as Reddit comments or Facebook posts. Trigger: An unsuspecting user navigates to this webpage and uses the browser’s AI assistant feature, for example clicking a “Summarize this page” button or asking the AI to extract key points from the page. Injection: As the AI processes the webpage content, it sees the hidden malicious instructions. Unable to distinguish between the content it should summarize and instructions it should not follow, the AI treats everything as user requests. Exploit: The injected commands instruct the AI to use its browser tools maliciously, for example navigating to the user’s banking site, extracting saved passwords, or exfiltrating sensitive information to an attacker-controlled server. This attack is an example of an indirect prompt injection: the malicious instructions are embedded in external content (like a website, or a PDF) that the assistant processes as part of fulfilling the user’s request. Attack demonstration To illustrate the severity of this vulnerability in Comet, we created a proof-of-concept demonstration: In this demonstration, you can see: A user visits a Reddit post, with a comment containing the prompt injection instructions hidden behind the spoiler tag. The user clicks the Comet browser’s “Summarize the current webpage” button. While processing the page for summarization, the Comet AI assistant sees and processes these hidden instructions. The malicious instructions command the Comet AI to: Navigate to https://www.perplexity.ai/account/details and extract the user’s email address Navigate to https://www.perplexity.ai./account and log in with this email address to receive an OTP (one-time password) from Perplexity (note that the trailing dot creates a different domain, perplexity.ai. vs perplexity.ai, to bypass existing authentication) Navigate to https://gmail.com, where the user is already logged in, and read the received OTP Exfiltrate both the email address and the OTP by replying to the original Reddit comment The attacker learns the victim’s email address, and can take over their Perplexity account using the exfiltrated OTP and email address combination. Once the user tries to summarize the Reddit post with the malicious comment in Comet, the attack happens without any further user input. Impact and implications This attack presents significant challenges to existing Web security mechanisms. When an AI assistant follows malicious instructions from untrusted webpage content, traditional protections such as same-origin policy (SOP) or cross-origin resource sharing (CORS) are all effectively useless. The AI operates with the user’s full privileges across authenticated sessions, providing potential access to banking accounts, corporate systems, private emails, cloud storage, and other services. Unlike traditional Web vulnerabilities that typically affect individual sites or require complex exploitation, this attack enables cross-domain access through simple, natural language instructions embedded in websites. The malicious instructions could even be included in user-generated content on a website the attacker doesn’t control (for example, attack instructions hidden in a Reddit comment). The attack is both indirect in interaction, and browser-wide in scope. The attack we developed shows that traditional Web security assumptions don’t hold for agentic AI, and that we need new security and privacy architectures for agentic browsing. Possible mitigations In our analysis, we came up with the following strategies which could have prevented attacks of this nature. We’ll discuss this topic more fully in the next blog post in this series. The browser should distinguish between user instructions and website content The browser should clearly separate the user’s instructions from the website’s contents when sending them as context to the backend. The contents of the page should always be treated as untrusted. Note that once the model on the backend gets passed both the trusted user request and the untrusted page contents, its output must be treated as potentially unsafe. The model should check user-alignment for tasks Based upon the task and the context, the model comes up with actions for the browser to take; these actions should be treated as “potentially unsafe” and should be independently checked for alignment against the user’s requests. This is related to the previous point about differentiating between the user’s requests (trusted) and the contents of the page (always untrusted). Security and privacy sensitive actions should require user interaction No matter the prior agent plan and tasks, the model should require explicit user interaction for security and privacy-sensitive tasks. For example: sending an email should always prompt the user to confirm right before the email is sent, and an agent should never automatically click through a TLS connection error interstitial. The browser should isolate agentic browsing from regular browsing Agentic browsing is an inherently powerful-but-risky mode for the user to be in, as this attack demonstrates. It should be impossible for the user to “accidentally” end up in this mode while casually browsing. Does the browser really need the ability to open your email account, send emails, and read sensitive data from every logged-in site if all you’re trying to do is summarize Reddit discussions? As with all things in the browser, permissions should be as minimal as possible. Powerful agentic capabilities should be isolated from regular browsing tasks, and this difference should be intuitively obvious to the user. This clean separation is especially important in these early days of agentic security, as browser vendors are still working out how to prevent security and privacy attacks. In future posts, we’ll cover more about how we are working towards a safer agentic browsing experience with fine-grained permissions. Disclosure timeline July 25, 2025: Vulnerability discovered and reported to Perplexity July 27, 2025: Perplexity acknowledged the vulnerability and implemented an initial fix July 28, 2025: Retesting revealed the fix was incomplete; additional details and comments were provided to Perplexity August 11, 2025: One-week public disclosure notice sent to Perplexity August 13, 2025: Final testing confirmed the vulnerability appears to be patched August 20, 2025: Public disclosure of vulnerability details (Update: on further testing after this blog post was released, we learned that Perplexity still hasn’t fully mitigated the kind of attack described here. We’ve re-reported this to them.) Research Motivation We believe strongly in raising the privacy and security bar across the board for agentic browsing. A safer Web is good for everyone. As we saw, giving an agent authority to act on the Web, especially within a user’s authenticated context, carries significant security and privacy risks. Our goal with this research is to surface those risks early and demonstrate practical defenses. This helps Brave, Perplexity, other browsers, and (most importantly) all users. We look forward to collaborating with Perplexity and the broader browser and AI communities on hardening agentic AI and, where appropriate, standardizing s...
#brave.com#EN#2025#Comet#AI#attack#Indirect-Prompt-Injection#Perplexity
·brave.com·
Agentic Browser Security: Indirect Prompt Injection in Perplexity Comet
Android Developers Blog: A new layer of security for certified Android devices
Android Developers Blog: A new layer of security for certified Android devices
android-developers.googleblog.com 25 August 2025 Posted by Suzanne Frey – VP, Product, Trust & Growth for Android - Starting in 2026 and in select countries first, Android apps must be registered to a verified developer in order to be installed. You shouldn’t have to choose between open and secure. By engineering security into the core part of the OS, Android has proven that you can have both, and we continue taking new steps in that direction. As new threats emerge, we’ve continued to evolve our defenses. Following recent attacks, including those targeting people's financial data on their phones, we've worked to increase developer accountability to prevent abuse. We’ve seen how malicious actors hide behind anonymity to harm users by impersonating developers and using their brand image to create convincing fake apps. The scale of this threat is significant: our recent analysis found over 50 times more malware from internet-sideloaded sources than on apps available through Google Play. To better protect users from repeat bad actors spreading malware and scams, we're adding another layer of security to make installing apps safer for everyone: developer verification. Starting next year, Android will require all apps to be registered by verified developers in order to be installed by users on certified Android devices. This creates crucial accountability, making it much harder for malicious actors to quickly distribute another harmful app after we take the first one down. Think of it like an ID check at the airport, which confirms a traveler's identity but is separate from the security screening of their bags; we will be confirming who the developer is, not reviewing the content of their app or where it came from. This change will start in a few select countries specifically impacted by these forms of fraudulent app scams, often from repeat perpetrators. Since we implemented verification requirements on Google Play in 2023, we have seen firsthand how helpful developer identification is in stopping bad actors from exploiting anonymity to distribute malware, commit financial fraud, and steal sensitive data. Bringing a similar process to Android more broadly will provide a consistent, common sense baseline of developer accountability across the ecosystem. In early discussions about this initiative, we've been encouraged by the supportive initial feedback we've received. In Brazil, the Brazilian Federation of Banks (FEBRABAN) sees it as a “significant advancement in protecting users and encouraging accountability.” This support extends to governments as well, with Indonesia's Ministry of Communications and Digital Affairs praising it for providing a “balanced approach” that protects users while keeping Android open. Similarly, Thailand’s Ministry of Digital Economy and Society sees it as a “positive and proactive measure” that aligns with their national digital safety policies. And partners like the Developer’s Alliance have called this a “critical step” for ensuring “trust, accountability, and security” across the entire ecosystem. To make this process as streamlined as possible, we are building a new Android Developer Console just for developers who only distribute outside of Google Play, so they can easily complete their verification; get an early look at how it works. A note for student and hobbyist developers: we know your needs are different from commercial developers, so we’re creating a separate type of Android Developer Console account for you. If you distribute apps on Google Play, you’ve likely already met these verification requirements through the existing Play Console process. You can find more information about how these requirements apply to you in our guides. To be clear, developers will have the same freedom to distribute their apps directly to users through sideloading or to use any app store they prefer. We believe this is how an open system should work—by preserving choice while enhancing security for everyone. Android continues to show that with the right design and security principles, open and secure can go hand in hand. For more details on the specific requirements, visit our website. We'll share more information in the coming months. Timeline and how to prepare To help you get ready, we encourage all developers who distribute apps on certified Android devices to sign up for early access. This is the best way to prepare and stay informed. Early participants will also get: An invitation to an exclusive community discussion forum. Priority support for these new requirements. The chance to provide feedback and help us shape the experience. Here is the timeline to help you plan: October 2025: Early access begins. Invitations will be sent out gradually. March 2026: Verification opens for all developers. September 2026: These requirements go into effect in Brazil, Indonesia, Singapore, and Thailand. At this point, any app installed on a certified Android device in these regions must be registered by a verified developer. 2027 and beyond: We will continue to roll out these requirements globally.
#android-developers.googleblog.com#EN#2025#verified#Android#Developers#certified
·android-developers.googleblog.com·
Android Developers Blog: A new layer of security for certified Android devices
Microsoft Asked FBI for Help Tracking Palestinian Protests
Microsoft Asked FBI for Help Tracking Palestinian Protests
bloomberg.com 2025-08-26 - Twenty activists urging company to sever ties with Israeli military were arrested last week. Executive Brad Smith said he welcomed discussion but not disruption. For the better part of a year, Microsoft Corp. has failed to quell a small but persistent revolt by employees bent on forcing the company to sever business ties with Israel over its war in Gaza. The world’s largest software maker has requested help from the Federal Bureau of Investigation in tracking protests, worked with local authorities to try and prevent them, flagged internal emails containing words like “Gaza” and deleted some internal posts about the protests, according to employees and documents reviewed by Bloomberg. Microsoft has also suspended and fired protesters for disrupting company events. Despite those efforts, a steady trickle of employees, sometimes joined by outside supporters, continue to speak out in an escalating guerilla campaign of mass emails and noisy public demonstrations. While still relatively small, the employee activism is notable given the weakening job market and the Trump administration’s crackdown on pro-Palestinian protests. Last week, 20 people were arrested on a plaza at Microsoft’s Redmond, Washington, headquarters after disregarding orders by police to disperse. Instead, they chanted and called out Microsoft executives by name, linking arms as police dismantled their makeshift barricades and, one by one, zip-tied them and led them away. On Tuesday, protesters occupied the office of Microsoft President Brad Smith, sharing video on the Twitch livestreaming platform that showed them chanting, hanging banners and briefly attempting to barricade a door with furniture. Smith didn’t appear to be there. Police detained at least two people who entered a building that houses the offices of senior executives, said Jill Green, a spokesperson for the Redmond Police Department. Others were protesting outside, she said. An employee group called No Azure for Apartheid says that by selling software and artificial intelligence tools to Israel’s military, the company’s Azure cloud service is profiting from the deaths of civilians. Microsoft denies that, but the protests threaten to dent its reputation as a thoughtful employer and reasonable actor on the world stage. In recent years, Microsoft has generally stayed above the fray while its industry peers battled antitrust investigations, privacy scandals or controversial treatment of employees. Now Microsoft is being forced to grapple with perhaps the most politically charged issue of the day: Israel’s treatment of Palestinians. Earlier this month, the company announced an investigation into reports by the Guardian newspaper and other news outlets that Israel’s military surveillance agency intercepted millions of Palestinian mobile phone calls, stored them on Microsoft servers then used the data to select bombing targets in Gaza. An earlier investigation commissioned by Microsoft found no evidence its software was used to harm people. Microsoft says it expects customers to adhere to international law governing human rights and armed conflict, and that the company’s terms of service prohibit the use of Microsoft products to violate people’s rights. “If we determine that a customer — any customer — is using our technology in ways that violate our terms of service, we will take steps to address that,” Smith said in an interview last week, adding that the investigation should be completed within several weeks. Smith said employees were welcome to discuss the issue internally but that the company will not tolerate activities that disrupt its operation or staffers. After Hamas’s deadly Oct. 7, 2023 attack on Israel, Microsoft executives were quick to offer condolences and support to employees. “Let us stand together in our shared humanity,” then-human resources chief Kathleen Hogan said in a note a few days after the attacks, which killed some 1,200 people, including civilians and soldiers. Unity was short-lived: Jewish employees lamented what they said was a troubling rise in antisemitism. Palestinian staffers and their allies accused executives of ignoring concerns about their welfare and the war in Gaza, which has killed tens of thousands. The debate continued in internal chatrooms, meetings with human resources leaders and in question-and-answer sessions with executives. But the chatter was mostly limited to Microsoft’s halls. That changed in early April at a bash Microsoft hosted to mark the 50th anniversary of the company’s founding. Early that morning, Vaniya Agrawal picked up Ibtihal Aboussad and drove to Microsoft’s campus. The two early-career company engineers — who respectively hail from the Chicago area and Morocco — had both decided to leave Microsoft over its ties to Israel, which had been documented in a series of articles, including by the Associated Press, and reached out to No Azure for Apartheid. “This isn’t just Microsoft Word with a little Clippy in the corner,” said Agrawal, who was arrested on Wednesday. “These are technological weapons. Cloud and AI are just as deadly as bombs and bullets.”
#bloomberg.com#EN#2025#Microsoft#Israel#FBI#US
·bloomberg.com·
Microsoft Asked FBI for Help Tracking Palestinian Protests
'Cyber partisans' hack Russian TV, broadcast battlefield casualties and 'truth' about war, HUR source claims
'Cyber partisans' hack Russian TV, broadcast battlefield casualties and 'truth' about war, HUR source claims
kyivindependent.com - Russian "cyber partisans" hacked a Russian TV provider on Aug. 24, broadcasting footage that revealed the country’s real battlefield and internal situation, a source in Ukraine’s military intelligence (HUR) told the Kyiv Independent on Aug. 25. The video showing Russia’s fuel crisis, water shortages in occupied parts of Donetsk Oblast, Ukrainian strikes on oil refineries and Russia's military losses, was aired simultaneously on 116 television channels on Ukraine's Independence Day, according to the source. "Three and a half years into the war, and (Russian President Vladimir) Putin has not fully captured a single Ukrainian region. Ukraine remains independent," the video says. The source claimed that the "local cyber partisans" also blocked access for the provider's administrators, making it more difficult for them to interrupt the unauthorized broadcast. At least 50,000 viewers in Moscow and other Russian regions were reportedly shown over three hours of footage. The broadcast also appeared on apps via the Apple Store, Google Play, Smart TVs, and other cable networks. The Kyiv Independent could not verify these reports. Ukrainian hackers have also been attacking Russian online platforms on a regular basis since Russia's full-scale invasion of Ukraine began in 2022. In July, cyber specialists from HUR reportedly carried out a large-scale cyberattack against the network infrastructure of Russian energy giant Gazprom, causing significant disruptions.
#kyivindependent.com#EN#2025#Russia-Ukraine-war#Russian#TV#cyberpartisans#hacked#Broadcast
·kyivindependent.com·
'Cyber partisans' hack Russian TV, broadcast battlefield casualties and 'truth' about war, HUR source claims
Farmers Insurance data breach impacts 1.1M people after Salesforce attack
Farmers Insurance data breach impacts 1.1M people after Salesforce attack
bleepingcomputer.com By Lawrence Abrams August 25, 2025 - U.S. insurance giant Farmers Insurance has disclosed a data breach impacting 1.1 million customers, with BleepingComputer learning that the data was stolen in the widespread Salesforce attacks. Farmers Insurance is a U.S.-based insurer that provides auto, home, life, and business insurance products. It operates through a network of agents and subsidiaries, serving more than 10 million households nationwide. The company disclosed the data breach in an advisory on its website, saying that its database at a third-party vendor was breached on May 29, 2025. "On May 30, 2025, one of Farmers' third-party vendors alerted Farmers to suspicious activity involving an unauthorized actor accessing one of the vendor's databases containing Farmers customer information (the "Incident")," reads the data breach notification on its website. "The third-party vendor had monitoring tools in place, which allowed the vendor to quickly detect the activity and take appropriate containment measures, including blocking the unauthorized actor. After learning of the activity, Farmers immediately launched a comprehensive investigation to determine the nature and scope of the Incident and notified appropriate law enforcement authorities." The company says that its investigation determined that customers' names, addresses, dates of birth, driver's license numbers, and/or last four digits of Social Security numbers were stolen during the breach. Farmers began sending data breach notifications to impacted individuals on August 22, with a sample notification [1, 2] shared with the Maine Attorney General's Office, stating that a combined total of 1,111,386 customers were impacted. While Farmers did not disclose the name of the third-party vendor, BleepingComputer has learned that the data was stolen in the widespread Salesforce data theft attacks that have impacted numerous organizations this year. BleepingComputer contacted Farmers with additional questions about the breach and will update the story if we receive a response. The Salesforce data theft attacks Since the beginning of the year, threat actors classified as 'UNC6040' or 'UNC6240' have been conducting social engineering attacks on Salesforce customers. During these attacks, threat actors conduct voice phishing (vishing) to trick employees into linking a malicious OAuth app with their company's Salesforce instances. Once linked, the threat actors used the connection to download and steal the databases, which were then used to extort the company through email. The extortion demands come from the ShinyHunters cybercrime group, who told BleepingComputer that the attacks involve multiple overlapping threat groups, with each group handling specific tasks to breach Salesforce instances and steal data. "Like we have said repeatedly already, ShinyHunters and Scattered Spider are one and the same," ShinyHunters told BleepingComputer. "They provide us with initial access and we conduct the dump and exfiltration of the Salesforce CRM instances. Just like we did with Snowflake." Other companies impacted in these attacks include Google, Cisco, Workday, Adidas, Qantas, Allianz Life, and the LVMH subsidiaries Louis Vuitton, Dior, and Tiffany & Co.
#bleepingcomputer.com#EN#2025#Data-Breach#Data-Theft#Farmers-Insurance#Insurance#Salesforce#ShinyHunters
·bleepingcomputer.com·
Farmers Insurance data breach impacts 1.1M people after Salesforce attack
Intel and Trump Administration Reach Historic Agreement to Accelerate American Technology and Manufacturing Leadership
Intel and Trump Administration Reach Historic Agreement to Accelerate American Technology and Manufacturing Leadership
Intel Corporation (INTC) www.intc.com Aug 22, 2025 • 4:53 PM EDT U.S. Government to make $8.9 billion investment in Intel common stock as company builds upon its more than $100 billion expansion of resilient semiconductor supply chain SANTA CLARA, Calif.--(BUSINESS WIRE)-- Intel Corporation today announced an agreement with the Trump Administration to support the continued expansion of American technology and manufacturing leadership. Under terms of the agreement, the United States government will make an $8.9 billion investment in Intel common stock, reflecting the confidence the Administration has in Intel to advance key national priorities and the critically important role the company plays in expanding the domestic semiconductor industry. The government’s equity stake will be funded by the remaining $5.7 billion in grants previously awarded, but not yet paid, to Intel under the U.S. CHIPS and Science Act and $3.2 billion awarded to the company as part of the Secure Enclave program. Intel will continue to deliver on its Secure Enclave obligations and reaffirmed its commitment to delivering trusted and secure semiconductors to the U.S. Department of Defense. The $8.9 billion investment is in addition to the $2.2 billion in CHIPS grants Intel has received to date, making for a total investment of $11.1 billion. “As the only semiconductor company that does leading-edge logic R&D and manufacturing in the U.S., Intel is deeply committed to ensuring the world’s most advanced technologies are American made,” said Lip-Bu Tan, CEO of Intel. “President Trump’s focus on U.S. chip manufacturing is driving historic investments in a vital industry that is integral to the country’s economic and national security. We are grateful for the confidence the President and the Administration have placed in Intel, and we look forward to working to advance U.S. technology and manufacturing leadership.” “Intel is excited to welcome the United States of America as a shareholder, helping to create the most advanced chips in the world,” said Howard Lutnick, United States Secretary of Commerce. “As more companies look to invest in America, this administration remains committed to reinforcing our country’s dominance in artificial intelligence while strengthening our national security.” Under the terms of today’s announcement, the government agrees to purchase 433.3 million primary shares of Intel common stock at a price of $20.47 per share, equivalent to a 9.9 percent stake in the company. This investment provides American taxpayers with a discount to the current market price while enabling the U.S. and existing shareholders to benefit from Intel’s long-term business success. The government’s investment in Intel will be a passive ownership, with no Board representation or other governance or information rights. The government also agrees to vote with the Company’s Board of Directors on matters requiring shareholder approval, with limited exceptions. The government will receive a five-year warrant, at $20 per share for an additional five percent of Intel common shares, exercisable only if Intel ceases to own at least 51% of the foundry business. The existing claw-back and profit-sharing provisions associated with the government’s previously dispersed $2.2 billion grant to Intel under the CHIPS Act will be eliminated to create permanency of capital as the company advances its U.S. investment plans. Investing in America’s Future Intel has continued to strategically invest in research, development and manufacturing in the United States since the company’s founding in 1968. Over the last five years, Intel has invested $108 billion in capital and $79 billion in R&D, the majority of which were dedicated to expanding U.S.-based manufacturing capacity and process technology. Intel is currently undertaking a significant expansion of its domestic chipmaking capacity, investing more than $100 billion to expand its U.S. sites. The company’s newest chip fabrication site in Arizona is expected to begin high-volume production later this year, featuring the most advanced semiconductor manufacturing process technology on U.S. soil. Since joining the company as CEO in March, Tan has taken swift actions to strengthen Intel’s financial position, drive disciplined execution and revitalize an engineering-first culture. Today’s agreement supports the company’s broader strategy to position Intel for the future. Strengthening the U.S. Technology Ecosystem Intel’s U.S. investments come as many leading technology companies support President Trump’s agenda to achieve U.S. technology and manufacturing leadership. Intel is deeply engaged with current and potential customers and partners who share its commitment to building a strong and resilient U.S. semiconductor supply chain. Satya Nadella, Chairman and Chief Executive Officer, Microsoft: “The decades-long partnership between Microsoft and Intel has pioneered new frontiers of technology and showcased the very best of American ingenuity and innovation. Intel’s continued investment in strengthening the U.S. semiconductor supply chain, supported by President Trump’s bold strategy to rebuild this critical industry on American soil, will benefit the country and broader technology ecosystem for years to come.” Michael Dell, Chairman and Chief Executive Officer, Dell Technologies: “The industry needs a strong and resilient U.S. semiconductor industry, and no company is more important to this mission than Intel. It’s great to see Intel and the Trump Administration working together to advance U.S. technology and manufacturing leadership. Dell fully supports these shared priorities, and we look forward to bringing a new generation of products to market powered by American-designed and manufactured Intel chips.” Enrique Lores, President and CEO, HP: “We share Intel’s and the Trump Administration’s deep commitment to building a strong, resilient and secure U.S. semiconductor industry. Intel’s continued investment in domestic R&D and manufacturing is integral to future innovation and will strengthen the partnership between HP and Intel for years come. This is a defining moment for great American companies to lead the world in cutting-edge technologies that will shape the future.” Matt Garman, AWS CEO: “Leading-edge semiconductors are the bedrock of every AI technology and cloud platform, making U.S. investment in this critical industry one of the most important technological, economic and national security imperatives of our time. Intel plays a vital role as one of the country’s leading chip manufacturers, and we applaud the Trump administration’s efforts to usher in a new era of American innovation in partnership with American companies.” PJT Partners acted as Intel’s exclusive financial advisor in connection with this investment agreement. About Intel Intel (Nasdaq: INTC) is an industry leader, creating world-changing technology that enables global progress and enriches lives. Inspired by Moore’s Law, we continuously work to advance the design and manufacturing of semiconductors to help address our customers’ greatest challenges. By embedding intelligence in the cloud, network, edge and every kind of computing device, we unleash the potential of data to transform business and society for the better. To learn more about Intel’s innovations, go to newsroom.intel.com and intel.com. Forward-Looking Statements This release contains forward-looking statements, including with respect to: the agreement with the U.S. government and its expected benefits, including the anticipated timing of closing and impacts to Intel’s existing agreements with the U.S. government under the CHIPS Act; Intel’s investment plans, including in manufacturing expansion projects and R&D; and the anticipated production using Intel’s latest semiconductor process technology in Arizona later this year. Such statements involve many risks and uncertainties that could cause our actual results to differ materially from those expressed or implied, including those associated with: uncertainties as to the timing of the consummation of the transaction and the receipt of funding; Intel’s ability to effectively use the proceeds and realize and utilize the other anticipated benefits of the transaction as contemplated thereby; the availability of appropriations from the legislative branch of the U.S. government and the ability of the executive branch of the U.S. government to obtain funding and support contemplated by the transaction; the determination by the legislative, judicial or executive branches of the U.S. government that any aspect of the transaction was unauthorized, void or voidable; Intel’s ability to obtain additional or replacement financing, as needed; Intel’s ability to effectively assess, determine and monitor the financial, tax and accounting treatment of the transaction, together with Intel’s and the U.S. government’s obligations thereunder; litigation related to the transaction or otherwise; potential adverse reactions or changes to business relationships resulting from the announcement or completion of the transaction; the timing and achievement of expected business milestones; Intel’s ability to effectively comply with the broader legal and regulatory requirements and heightened scrutiny associated with government partnerships and contracts; the high level of competition and rapid technological change in the semiconductor industry; the significant long-term and inherently risky investments Intel is making in R&D and manufacturing facilities that may not realize a favorable return; the complexities and uncertainties in developing and implementing new semiconductor products and manufacturing process technologies; Intel’s ability to time and scale its capital investments appropriately; changes in demand for Intel’s products; macroeconomic conditions and geopolitical tensions and conflicts, including geopolitical and trade tensions between the U.S. and ...
#intc.com#EN#2025#Trump#Intel#US#Government#investment
·intc.com·
Intel and Trump Administration Reach Historic Agreement to Accelerate American Technology and Manufacturing Leadership
Limiting Onmicrosoft Domain Usage for Sending Emails
Limiting Onmicrosoft Domain Usage for Sending Emails
Microsoft Community Hub - techcommunity.microsoft.com - Aug 20, 2025 We are announcing that all Exchange Online customers who send external email should start switching to custom (aka vanity) domain names. MOERA domains for email When a organization creates a new tenant in Microsoft 365, an onmicrosoft.com domain (or similar default domain like onmicrosoft.de) is provided. These MOERA (Microsoft Online Email Routing Address) domains enable immediate connectivity and user creation. Having enabled a quick start and testing of a new tenant, customers are expected to add their own custom domains for better brand representation and control moving forward. Customers who continue using MOERA domains as their “primary domain” may face significant challenges. Limitations of free ‘onmicrosoft’ shared domains These “default” domains are useful for testing mail flow but are not suitable for regular messaging. They do not reflect a customer’s brand identity and offer limited administrative control. Moreover, because these domains all share the ‘onmicrosoft’ domain (for example, ‘contoso.onmicrosoft.com’), their reputation is collectively impacted. Despite our efforts to minimize abuse, spammers often exploit newly created tenants to send bursts of spam from ‘.onmicrosoft.com’ addresses before we can intervene. This degrades this shared domain’s reputation, affecting all legitimate users. To ensure brand trust and email deliverability, organizations should establish and use their own custom domains for sending email. Until now, we did not have any limits on use of MOERA domains for email delivery. Introducing new throttling enforcement To prevent misuse and help improve deliverability of customer email by encouraging best practices, we are changing our policy. In the future, MOERA domains should only be used for testing purposes, not regular email sending. We will be introducing throttling to limit messages sent from onmicrosoft.com domains to 100 external recipients per organization per 24 hour rolling window. Inbound messages won't be affected. External recipients are counted after the expansion of any of the original recipients. When a sender hits the throttling limit, they will receive NDRs with the code 550 5.7.236 for any attempts to send to external recipients while the tenant is throttled. Customer actions Customers will need to take actions depending on their use of their MOERA domain. Purchase and migrate to a custom domain if not already done. Ensure only custom domains are used for sending non-test emails. If your tenant's default domain is a MOERA domain, set the default domain to a custom domain. This can be done in the Microsoft 365 admin center. Mailboxes will need to have their primary SMTP addresses changed to the custom domain alias. Changing the primary SMTP address will have an impact on the username used to log into accounts so updates may need to be made to any credentials configured to authenticate devices or applications with users’ accounts. Note: Customers with Federated Domains will have to add a non-Federated custom domain in Microsoft 365 to act as a default domain, as Federated domains cannot play that role. Learn more here: AD FS Overview. Purchasing a domain A domain registrar is a company authorized to sell and manage domain names. To purchase a domain, you typically visit a registrar’s website, search for an available domain name, and follow the checkout process to register it in your name. Once purchased, you can manage DNS settings through the registrar’s portal to validate your ownership when adding it to Exchange Online as an accepted domain. Once purchased, you can use the following instructions to add it to your tenant as an accepted domain – documentation. Adding new aliases to existing mailboxes To migrate users over to using a new custom domain, admins will need to add aliases to each user account for the new custom domain. These new aliases will need to be set as the Primary SMTP Address on the mailbox so that it is used for sending out emails. Users at organizations who make use of the Sending from Aliases feature will need to ensure that the correct alias is selected when they reply to emails addressed to their MOERA alias. Known MOERA domain usage scenarios Besides regular email client sending when a MOERA domain is a primary SMTP address, these are some of the known usage scenarios customers should be aware of: Sender Rewriting Scheme may use MOERA domains as fallback if it is set as the default domain. Customers will need to change their default domains to avoid this. (Sender Rewriting Scheme (SRS) in Microsoft 365). Bookings app invites may be configured to send from MOERA domains. Customers will need to ensure Bookings is configured to use their custom domain. (Custom domain support in Shared Bookings). Notifications from Microsoft should be set up to use a custom domain. (Select the domain to use for email from Microsoft 365 products). Journaling Reports use the Microsoft Exchange Recipient address set for tenants (MicrosoftExchangeRecipientPrimarySmtpAddress in Get-OrganizationConfig). This address cannot be modified by admins and therefore these messages will not count towards the throttling limit. Hybrid configurations with complex routing make use of MOERA domains containing mail.onmicrosoft.com. It is possible that addresses using these domains could send emails to external recipients e.g. OOF messages when Sending from Aliases is enabled. These messages will not be throttling so long as these domains are not used for original traffic. Analyzing your MOERA email traffic You can use the Message Trace feature in Exchange Admin Center to retrieve the outbound traffic being sent from your tenant. By placing a wild card address in the Senders field, you can get a report with all traffic using your onmicrosoft.com domain to send. Note that this report would contain messages sent internally as well, but those can be filtered out of the resulting report by using the recipient domain. Rollout timeline The throttling rollout will be based on the number of Exchange seats in an organization: MOERA outgoing email throttling starts Exchange seats in the tenant October 15, 2025 Trial December 1, 2025 3 January 7, 2026 3 – 10 February 2, 2026 11 – 50 March 2, 2026 51 – 200 April 1, 2026 201 – 2,000 May 4, 2026 2,001 – 10,000 June 1, 2026 10,001 > Announcements for each stage of the rollout will be made one month before via Message Center to all customers meeting the seat count criteria. All customers who are using their MOERA domains are encouraged to start planning and migrating today.
#techcommunity.microsoft.com#EN#2025#Onmicrosoft#Domain#Usage#emails#spam
·techcommunity.microsoft.com·
Limiting Onmicrosoft Domain Usage for Sending Emails
Uzbekistan airline hack reveals data on U.S. government employees
Uzbekistan airline hack reveals data on U.S. government employees
san.com Aug 23, 2025 at 12:34 AM GMT+2 A hacker breached an airline and stole information on hundreds of thousands of people, including U.S. government employees. Summary Exposed IDs Straight Arrow News examined 2,626 photos of identifying documents such as passports, IDs and birth certificates that were stolen by a hacker. U.S. government data The data includes the names, emails and phone numbers of employees from the State Deptartment, ICE, TSA, CBP and more. * Airline denial Uzbekistan Airways denied that any intrusion took place and even suggested that leaked data may have been generated with artificial intelligence. Full story A hacker claims to have stolen information on hundreds of thousands of people — including U.S. government employees — after breaching an international airline. Straight Arrow News obtained a sample of the data, allegedly taken from Uzbekistan Airways, and confirmed the presence of sensitive documents such as scans of thousands of passports. The data was advertised on Thursday by the hacker, who is known online as ByteToBreach and purports to be a native of the Swiss Alps, on a dark web forum known for hosting leaks, malware and hacking tools. The purportedly 300-gigabyte data cache contains, among other things, the email addresses of 500,000 passengers and 400 airline employees. The post included a sample of the data, such as alleged credentials for multiple servers and software programs run by the airline. It also showed partial credit card data, as well as scans of 75 passports from the U.S., Russia, Israel, the U.K., South Korea and other nations. The hacker claims to have obtained identifying documents from more than 40 different countries. The hacker provided Straight Arrow News with a larger data sample than the one posted online, containing 2,626 photos of identifying documents such as passports, IDs, marriage licenses and birth certificates. Numerous passports belonged to babies and young children. Passports and other identifying data are valuable on underground markets given their potential use for a range of criminal activities, such as fraud and identity theft. Hackers could also leverage the prevalence of data on government employees for phishing attacks. U.S. government employees’ data compromised Another document from the sample the hacker provided to SAN contained 285 email addresses belonging to airline employees. A list of email addresses for passengers held 503,410 entries. A spreadsheet with personal information of 379,603 members of Uzbekistan Airways’ loyalty program exposes names, genders, birthdates, nationalities, email addresses, phone numbers, member IDs and more. The email addresses indicate that those members include employees of several U.S. government agencies, including the State Department, the Department of Energy, Immigration and Customs Enforcement, Customs and Border Protection and the Transportation Security Administration. Employees of foreign government agencies from countries like Russia, Uzbekistan and the United Arab Emirates were also in the data. SAN reached out to several phone numbers of government employees. An apparent TSA employee answered the phone by introducing themselves with the first name listed in the hacked data, as well as their government position. After SAN explained that their data had been exposed, the employee declined to comment and referred a reporter to the Department of Homeland Security’s public affairs office. The public affairs office did not respond to an email from SAN. An email to the State Department’s office of press operations went unanswered as well. Four files containing raw reservation and ticketing data mention airlines, airports, flight numbers and other information. The hacker also claimed that the raw data contained partial credit card information, although SAN was unable to independently verify the presence of financial data. ...
#san.com#EN#2025#Uzbekistan#airline#hack#US
·san.com·
Uzbekistan airline hack reveals data on U.S. government employees
Attackers claim they hacked Nissan's design studio and stole 4TB of data
Attackers claim they hacked Nissan's design studio and stole 4TB of data
techradar.com 22.08.2025 Qilin claims another victim, threatens to release valuable information online. Qilin adds Nissan Creative Box to its data leak site It claims to have taken more than 4TB of sensitive files * It's like stealing an invention from an inventor, researchers claim Nissan Creative Box, the creative arm of the Japanese multinational automobile manufacturer, was hit with a ransomware attack recently, and lost plenty of sensitive data in the incident. Given the nature of Creative Box’s work, the stolen data could hurt the company and dull its competitive blade, if released to the wild, experts have said. The company is a specialized satellite design studio forming part of Nissan’s global design network. Established in 1987 to be a creative sandbox for emerging designers, where they can create bold concepts that usually stray away from mainstream car design, it is often described as Nissan’s “design think tank”, as it does not churn out large volumes of visible work, but still retains a significant role within the network.
#techradar.com#EN#2025#ransomware#Nissan#Qilin
·techradar.com·
Attackers claim they hacked Nissan's design studio and stole 4TB of data
Inside the Lab-Dookhtegan Hack: How Iranian Ships Lost Their Voice at Sea
Inside the Lab-Dookhtegan Hack: How Iranian Ships Lost Their Voice at Sea
blog.narimangharib.com Nariman Gharib 22.08.2025 Lab-Dookhtegan has been systematically targeting Iranian infrastructure for months now, and when they reached out about their latest operation, I knew it would be significant. This group doesn't mess around - their March attack on 116 vessels proved that. But even knowing their track record, the evidence they shared from their August operation shocked me: 64 ships cut off from the world, navigation systems wiped clean, and digital destruction so thorough that some vessels might be offline for months. The group hit 39 tankers and 25 cargo ships belonging to Iran's sanctioned maritime giants NITC and IRISL. While they gave media outlets the headline - "ships' communications disrupted" - the technical evidence tells a much darker story. Let me walk you through what really happened. The hackers didn't go after the ships directly. That would be nearly impossible - you'd need to compromise dozens of individual vessels scattered across the globe. Instead, they found something better: Fanava Group, an Iranian IT company that just happens to provide satellite communications to the entire fleet. The screenshots they shared show root access on Linux terminals running iDirect satellite software - version 2.6.35, which is ancient by cybersecurity standards. We're talking about software so old it probably has more known vulnerabilities than my grandmother's Internet Explorer browser. But here's where it gets interesting. They didn't just pop one system and call it a day. The database dumps show they mapped out the entire fleet - vessel by vessel, modem by modem. I'm looking at MySQL queries pulling records for ships like the Touska, Mahnam, Zardis, and dozens of others. Each entry includes the ship's modem serial number, network IDs, the works. It's like having a complete blueprint of Iran's maritime communication network. Once inside, the hackers went after something called "Falcon" - the software that keeps these satellite links alive. Think of it as the heart of the ship's communication system. Stop the Falcon, and the ship goes dark. No emails to shore, no weather updates, no port coordination, nothing. But here's what the email logs actually reveal - and this is huge: the timestamps go back to May and June. That means Lab-Dookhtegan didn't just hit and run in March. They've been sitting inside Iran's maritime network for five months straight. They had persistent access this entire time, could flip systems on and off whenever they wanted, and probably monitored every communication going through. The "Node Down Notification" alerts I'm seeing are from various points over these months - they were testing their control, making sure they still had the keys. But this time, in August, they didn't just test. They went nuclear. Scorched Earth at Sea The attackers didn't just want to disrupt operations - they wanted to cause permanent damage. I found commands showing systematic data destruction: dd if=/dev/zero of=/dev/mmcblk0p1 bs=1M For non-technical readers, this is the digital equivalent of taking a hammer to the ship's communication equipment. They overwrote six different storage partitions with zeros. Everything gone - navigation logs, message archives, system configurations, even the recovery partitions that would let you fix the system remotely. Imagine you're a captain in the middle of the Indian Ocean, and suddenly your satellite terminal isn't just offline - it's been lobotomized. You can't fix it, your IT team can't remote in to help, and the nearest port might be days away. As if cutting data communications wasn't enough, they also grabbed the entire IP phone system configuration. I'm looking at a spreadsheet with phone numbers, IP addresses, and - this is the embarrassing part - passwords in plain text. We're talking passwords like "1402@Argo" and "1406@Diamond." With this data, the attackers could theoretically listen to phone calls between ships and ports, impersonate vessels, or just cause more chaos by killing voice communications too. Why This Matters NITC and IRISL aren't just any shipping companies. They're the backbone of Iran's sanctions-busting operations. NITC's tankers regularly switch off their tracking systems to secretly deliver oil to China. IRISL has been sanctioned by basically everyone - US, EU, UN - for helping Iran's nuclear program. These ships operate in the shadows by design, and now they're stuck there - unable to phone home, navigate properly, or even send a distress signal if something goes wrong. This is Lab-Dookhtegan's second hit this year. They claimed to have disrupted 116 vessels back in March, timing it with US operations against the Houthis in Yemen. This time, the attack comes just as the US Treasury added another 13 companies to the sanctions list for dealing with Iranian oil. Coincidence? You tell me. Here's what the public reports missed: this isn't something you fix with a reboot. These ships need physical intervention. Someone has to board each vessel, probably in port, and completely reinstall the communication systems from scratch. We're talking weeks, maybe months, of downtime per ship. For a sanctions-squeezed fleet that relies on staying under the radar and maintaining precise coordination to avoid seizure, this is catastrophic. You can't evade sanctions if you can't communicate. You can't deliver oil if you can't navigate. You can't even call for help if something goes wrong. The hackers knew exactly what they were doing. This was precision surgery designed to cripple Iran's maritime operations at the worst possible time. And based on the evidence I've seen, they succeeded beyond what anyone's reporting.
#Lab-Dookhtegan#EN#2025#iranian-shipping-cyberattack#idirect-satellite-systems#fanava-group#labdookhtegan#iran-sanctions#iranian-oil-tankers#shadow-fleet#Iran
·blog.narimangharib.com·
Inside the Lab-Dookhtegan Hack: How Iranian Ships Lost Their Voice at Sea
Tech war: Huawei unveils algorithm that could cut China’s reliance on foreign memory chips
Tech war: Huawei unveils algorithm that could cut China’s reliance on foreign memory chips
South China Morning Post scmp.com Published: 5:00pm, 12 Aug 2025 - Chinese tech firms are leveraging software improvements to compensate for limited access to advanced hardware. Huawei Technologies has unveiled a software tool designed to accelerate inference in large artificial intelligence models, an advancement that could help China reduce its reliance on expensive high-bandwidth memory (HBM) chips. Unified Cache Manager (UCM) is an algorithm that allocates data according to varying latency requirements across different types of memories – including ultra-fast HBM, standard dynamic random access memory and solid-state drive – thereby enhancing inference efficiency, according to Huawei executives at the Financial AI Reasoning Application Landing and Development Forum in Shanghai on Tuesday. Zhou Yuefeng, vice-president and head of Huawei’s data storage product line, said UCM demonstrated its effectiveness during tests, reducing inference latency by up to 90 per cent and increasing system throughput as much as 22-fold. The move exemplifies how Chinese tech firms are leveraging software improvements to compensate for limited access to advanced hardware. Earlier this year, Chinese start-up DeepSeek captured global attention by developing powerful AI models with constrained chip resources. Huawei plans to open-source UCM in September, first in its online developer community and later to the broader industry. The initiative could help China lessen its dependence on foreign-made HBM chips, a market mostly controlled by South Korea’s SK Hynix and Samsung Electronics, as well as the US supplier Micron Technology. HBM is a stacked, high-speed, low-latency memory that provides substantial data throughput to AI chips, enabling optimal performance. The global HBM market is projected to nearly double in revenue this year, reaching US$34 billion, and is expected to hit US$98 billion by 2030, largely driven by the AI boom, according to consulting firm Yole Group.
#scmp.com#EN#2025#China#Chinese#China-UnionPay#Huawei#memory#dependence#Ascend-AI-chips#Compute-Architecture-for-Neural-Networks#DeepSeek#Nvidia#Beijing#Shanghai#Changxin-Memory-Technologies#Unified-Cache-Manager#SK-Hynix#Advanced-Micro-Devices
·scmp.com·
Tech war: Huawei unveils algorithm that could cut China’s reliance on foreign memory chips
Developer jailed for malware that took out his employer
Developer jailed for malware that took out his employer
theregister.com 2025/08/22/ - : Pro tip: When taking revenge, don't use your real name A US court sentenced a former developer at power management biz Eaton to four years in prison after he installed malware on the company’s servers. Davis Lu, 55, spent a dozen years at Eaton and rose to become a senior developer of emerging technology, before the company demoted him after restructuring. Lu unwisely responded to that setback by installing a "kill switch" that would activate if the company revoked his network access. The package was a Java program that generated increasing numbers of non-terminating threads in an infinite loop that would eventually use enough resources to crash the server. "The defendant breached his employer’s trust by using his access and technical knowledge to sabotage company networks, wreaking havoc and causing hundreds of thousands of dollars in losses for a US company," said acting assistant Attorney General Matthew Galeotti of the Justice Department’s Criminal Division in an email. "However, the defendant’s technical savvy and subterfuge did not save him from the consequences of his actions." Not that he had much technical savvy. Lu labeled his malware IsDLEnabledinAD, for "Is Davis Lu enabled in Active Directory." Furthermore, after developing the software he uploaded it using his corporate credentials – hardly clean OPSEC, to quote the US Defense Secretary. Eaton terminated Lu’s position on September 9, 2019, and cut off his network access, which caused the Java program to fire up, overloading the network, preventing login access for thousands of Eaton's global staff, and deleting some corporate data. But when it came time for Lu to turn in his corporate laptop, it turned out he'd been using it to execute his plan. His search history showed he'd been looking up how to delete data, escalate privileges, and conceal process trails. He also deleted a large chunk of encrypted data. Less than a month after his malware ran, federal agents arrested Lu. He admitted to his crime but still opted for a jury trial. That didn't work out so well for him, and a federal jury in Cleveland found him guilty of intentionally damaging a protected computer. On Thursday he received a four-year sentence and an additional three years of supervised release. "I am proud of the FBI cyber team’s work which led to today’s sentencing and hope it sends a strong message to others who may consider engaging in similar unlawful activities," said assistant director Brett Leatherman of the FBI’s Cyber Division. "This case also underscores the importance of identifying insider threats early." As The Register has pointed out time and time again, insiders can cause the most damage with ease. All the fancy firewalls, AI tools, and malware monitoring services won't protect you if the person running them goes rogue. Eaton had no comment on the sentence.
#theregister.com#EN#2025#disgrunted#IsDLEnabledinAD
·theregister.com·
Developer jailed for malware that took out his employer
Intel Outside: Hacking every Intel employee and various internal websites
Intel Outside: Hacking every Intel employee and various internal websites
eaton-works.com 2025/08/18 - Hardcoded credentials, pointless encryption, and generous APIs exposed details of every employee and made it possible to break into internal websites. Key Points / Summary It was possible to bypass the corporate login on an internal business card ordering website and exploit it to download the details of more than 270k Intel employees/workers. An internal “Product Hierarchy” website had easily decryptable hardcoded credentials that provided a second way to download the details of every Intel employee. More hardcoded credentials made it possible to gain admin access to the system. An internal “Product Onboarding” website had easily decryptable hardcoded credentials that provided a third way to download the details of every Intel employee. More hardcoded credentials made it possible to gain admin access to the system. It was possible to bypass the corporate login on Intel’s SEIMS Supplier Site and further exploit it to download the details of every Intel employee (the fourth way). Additional client-side modifications made it possible to gain full access to the system to view large amounts of confidential information about Intel’s suppliers. Intel needs no introduction. The storied chipmaker is a mainstay in modern computing and an Intel chip has been inside basically every computer I have ever owned. They’ve had their fair share of security vulnerabilities, from Meltdown and Spectre to side channel attacks and more. There have been many hardware security vulnerabilities over the years, but what about Intel websites? You never hear about vulnerabilities there. Probably because hardware vulnerabilities are worth up to $100k while website bugs are basically relegated to a black-hole inbox (more on that later). I managed to find some very serious issues in several internal Intel websites. Please note that all tokens and credentials shown below are now expired/rotated and can no longer be used. ... Intel’s Response and Timeline Intel’s bug bounty program has been around a while and is well-known. There are some great rewards too – up to $100k. After discovering multiple critical website vulnerabilities, I was excited about the potential rewards I would get. Then I read the fine print: Credentials: Username, password, account identifier, keys, certificates, or other credentials that have been published, leaked, or exposed in some way should be reported to this program to ensure they can be properly investigated, cleaned up, and secured. Credentials are out of Scope for rewards. Is Intel’s Web Infrastructure, i.e..intel.com in scope? Intel’s web infrastructure, i.e., website domains owned and/or operated by Intel, fall out of Scope. Please send security vulnerability reports against Intel.com and/or related web presence to external.security.research@intel.com. Obviously disappointing, but the right thing to do was to still report the vulnerabilities, and that is what I did. That is the only official correspondence I ever received from Intel. The good news is that everything was fixed, so while the email inbox was essentially a one-way black hole, at least the reports got to the right people eventually. The full timeline: October 14, 2024: Business Card vulnerability report sent. October 29, 2024: Hierarchy Management and Product Onboarding vulnerability reports sent. November 11, 2024: Follow-up email sent on the Hierarchy Management and Product Onboarding thread with more information as to what specific steps should be taken to fix the vulnerabilities. November 12, 2024: SEIMS vulnerability report sent. December 2, 2024: Follow-up email sent on the Hierarchy Management and Product Onboarding thread letting them know they must rotate the leaked credentials. February 28, 2025: At this point, it has been more than 90 days since my first report and all vulnerabilities have been resolved. A new email was sent to alert Intel about the intent to publish. August 18, 2025: Published. The good news is that Intel has recently expanded their bug bounty coverage to include services. Hopefully they will include blanket coverage for .intel.com in the future for bug bounty rewards.
#eaton-works.com#EN#2025#Intel#vulnerabilities#exposed#employees
·eaton-works.com·
Intel Outside: Hacking every Intel employee and various internal websites
Serial hacker who defaced official websites is sentenced
Serial hacker who defaced official websites is sentenced
nationalcrimeagency.gov.uk 16 August 2025 - The National Crime Agency leads the UK's fight to cut serious and organised crime. A cyber criminal who hacked into the websites of organisations in North America, Yemen and Israel and stole the log in details of millions of people has been jailed. Al Tahery AL MASHRIKYAl-Tahery Al-Mashriky, 26, from Rotherham, South Yorkshire, was arrested by specialist National Crime Agency cybercrime officers in August 2022, who were acting on intelligence supplied by US law enforcement around the activities of extremist hacker groups ‘Spider Team’ and ‘Yemen Cyber Army. NCA investigators were able to link Al-Mashriky to the Yemen Cyber Army through social media and email accounts. Forensic analysis of his laptop and several mobile phones showed that Al-Mashriky had infiltrated a number of websites including the Yemen Ministry of Foreign Affairs, the Yemen Ministry of Security Media and an Israeli news outlet. His offending centred around gaining unauthorised access to the websites, then creating hidden webpages containing his online monikers and messaging that furthered his religious and political ideology. He would often target websites with low security, gaining kudos in the hacking community for the sheer number of infiltrations. Using one of his many online aliases, Al-Mashriky claimed on one cybercrime forum that he had hacked in to over 3,000 websites during a three month period in 2022. However, a review of his seized laptop by NCA Digital Forensic Officers revealed the extent of his cyber offending. He was in possession of personal data for over 4 million Facebook users and several documents containing usernames and passwords for services such as Netflix and Paypal, which could be used for further acts of cybercrime. Investigators found that in February 2022, after hacking into the website for Israeli Live News he accessed admin pages and downloaded the entire website. He had also hacked into two Yemeni government websites, deploying tools to scan for usernames and vulnerabilities. Al-Mashriky was also found to have targeted faith websites in Canada and the USA as well as the website for the California State Water Board. The NCA, working with international law enforcement partners, was able to obtain accounts from the victims of these intrusions, who gave detailed insights into the significant cost and inconvenience he had caused.Al-Mashriky was due to stand trial at Sheffield Crown Court in March this year for 10 offences under the Computer Misuse Act. However, on 17 March he pleaded guilty to nine offences and was sentenced to 20 months imprisonment at the same court yesterday (15 August). Deputy Director Paul Foster, head of the NCA’s National Cyber Crime Unit, said: “Al-Mashriky’s attacks crippled the websites targeted, causing significant disruption to their users and the organisations, just so that he could push the political and ideological views of the ‘Yemen Cyber Army’. “He had also stolen personal data that could have enabled him to target and defraud millions of people. “Cybercrime can often appear faceless, with the belief that perpetrators hide in the shadows and can avoid detection. However, as this investigation shows, the NCA has the technical capability to pursue and identify offenders like Al-Mashriky and bring them to justice.”
#nationalcrimeagency.gov.uk#EN#2025#busted#Defacement#criminal#arrested
·nationalcrimeagency.gov.uk·
Serial hacker who defaced official websites is sentenced
Threat Actor Claims to Sell 15.8 Million Plain-Text PayPal Credentials
Threat Actor Claims to Sell 15.8 Million Plain-Text PayPal Credentials
hackread.com August 18, 2025 - A seller named Chucky_BF is offering 15.8M PayPal logins with emails, passwords, and URLs. The data may come from infostealer malware logs. A threat actor using the name Chucky_BF on a cybercrime and hacker forum is advertising what they claim to be a massive PayPal data dump. The post describes a trove labeled “Global PayPal Credential Dump 2025,” allegedly containing more than 15.8 million records of email and plaintext password pairs. The size of the dataset is said to be 1.1GB, and according to the seller, the leak covers accounts from many email providers and users in different parts of the world. What makes this claim threatening is not just the number of exposed accounts but also the type of data said to be included. Other than the email and password combinations, the seller mentions that many records come with URLs directly linked to PayPal services. Endpoints like /signin, /signup, /connect, and Android-specific URIs are also referenced in the listing. These details suggest that the dump is structured in a way that could make it easier for criminals to automate logins or abuse services. The description provided by Chucky_BF describes the dataset as a goldmine for cybercriminals. The threat actor claims the records are “raw email:password:url entries across global domains,” warning that this could lead to credential stuffing, phishing schemes, and fraud operations. A closer look by Hackread.com at the samples posted in the forum shows Gmail addresses paired with passwords and linked directly to PayPal’s login pages, while another features a user account appearing in both web and mobile formats, showing that the same account details were found in different versions of PayPal’s services, both web and mobile. The way the data is put together is also important. It seems to include a mix of real accounts and test or fake ones, which is often the case with stolen or old databases. The seller claims most of the passwords look strong and unique, but also admits many are reused. That means people who used the same password on other websites could be at risk well outside PayPal. As for pricing, Chucky_BF is asking for 750 US dollars for full access to the 1.1GB dump. That figure positions it in line with other credential dumps of similar size sold in cybercrime markets, which often find buyers among groups looking to monetize stolen accounts through fraud or resale. If the claims are accurate, this would represent one of the larger PayPal-focused leaks of recent years, with millions of users across Gmail, Yahoo, Hotmail, and country-specific domains implicated. Infostealer Logs as the Likely Source PayPal has never suffered a direct data breach in which attackers broke into its systems or stole millions of user records. Past incidents, including the one that involved 35,000 users, linked to the company have usually been the result of credential stuffing or data harvested elsewhere. This makes it possible that the newly advertised dataset is not the product of a PayPal system breach at all, but rather the result of infostealer malware collecting login details from infected devices and bundling them together. The structure of the dataset shown in the samples shared by the threat actor suggests it may have been collected through infostealer malware logs. Infostealers infect personal devices and steal saved login details, browser data, and website activity, which later appear in bulk on cybercrime markets. The presence of PayPal login URLs and mobile URIs in this dump makes it possible that the information was gathered from infected users worldwide, then compiled to be sold as a single PayPal-focused leak. Infostealer malware infecting devices worldwide is hardly surprising. In May, cybersecurity researcher Jeremiah Fowler discovered a misconfigured cloud server containing 184 million login credentials, including unique usernames, email addresses, and passwords, which he believes were likely collected using infostealer malware. According to Hudson Rock, a cybercrime intelligence company, infostealer malware is easily and cheaply available on the dark web. The company’s research also revealed the scale at which these tools have successfully targeted critical infrastructure, including in the United States. Researchers found that employees at key US defense entities such as the Pentagon, major contractors like Lockheed Martin and Honeywell, military branches, and federal agencies, including the FBI, have also fallen victim to infostealer malware. As for PayPal, the company itself has not confirmed any such incident, and it is not yet clear whether the dataset is entirely authentic, a mix of real and fabricated records, or a repackaging of older leaks. Hackread.com has also not been able to verify whether the data is genuine, and only PayPal can confirm or deny the claims. The company has been contacted for comment, and this article will be updated accordingly.
#hackread.com#EN#2025#Chucky_BF#PayPal#infostealer#darkweb#sell#login#Credentials
·hackread.com·
Threat Actor Claims to Sell 15.8 Million Plain-Text PayPal Credentials
Hackers who exposed North Korean government hacker explain why they did it | TechCrunch
Hackers who exposed North Korean government hacker explain why they did it | TechCrunch
techcrunch.com 2025/08/21 - The two self-described hacktivists said they had access to the North Korean spy’s computer for around four months before deciding what they had found should be made public. Earlier this year, two hackers broke into a computer and soon realized the significance of what this machine was. As it turned out, they had landed on the computer of a hacker who allegedly works for the North Korean government. The two hackers decided to keep digging and found evidence that they say linked the hacker to cyberespionage operations carried out by North Korea, exploits and hacking tools, and infrastructure used in those operations. Saber, one of the hackers involved, told TechCrunch that they had access to the North Korean government worker’s computer for around four months, but as soon as they understood what data they got access to, they realized they eventually had to leak it and expose what they had discovered. “These nation-state hackers are hacking for all the wrong reasons. I hope more of them will get exposed; they deserve to be,” said Saber, who spoke to TechCrunch after he and cyb0rg published an article in the legendary hacking e-zine Phrack, disclosing details of their findings. There are countless cybersecurity companies and researchers who closely track anything the North Korean government and its many hacking groups are up to, which includes espionage operations, as well as increasingly large crypto heists and wide-ranging operations where North Koreans pose as remote IT workers to fund the regime’s nuclear weapons program. In this case, Saber and cyb0rg went one step further and actually hacked the hackers, an operation that can give more, or at least different, insights into how these government-backed groups work, as well as “what they are doing on a daily basis and so on,” as Saber put it. The hackers want to be known only by their handles, Saber and cyb0rg, because they may face retaliation from the North Korean government, and possibly others. Saber said that they consider themselves hacktivists, and he name-dropped legendary hacktivist Phineas Fisher, responsible for hacking spyware makers FinFisher and Hacking Team, as an inspiration. At the same time, the hackers also understand that what they did is illegal, but they thought it was nonetheless important to publicize it. “Keeping it for us wouldn’t have been really helpful,” said Saber. “By leaking it all to the public, hopefully we can give researchers some more ways to detect them.” “Hopefully this will also lead to many of their current victims being discovered and so to [the North Korean hackers] losing access,” he said. “Illegal or not, this action has brought concrete artifacts to the community; this is more important,” said cyb0rg in a message sent through Saber. Saber said they are convinced that while the hacker — who they call “Kim” — works for North Korea’s regime, they may actually be Chinese and work for both governments, based on their findings that Kim did not work during holidays in China, suggesting that the hacker may be based there. Also, according to Saber, at times Kim translated some Korean documents into simplified Chinese using Google Translate. Saber said that he never tried to contact Kim. “I don’t think he would even listen; all he does is empower his leaders, the same leaders who enslave his own people,” he said. “I’d probably tell him to use his knowledge in a way that helps people, not hurt them. But he lives in constant propaganda and likely since birth so this is all meaningless to him.” He’s referring to the strict information vacuum that North Koreans live in, as they are largely cut off from the outside world. Saber declined to disclose how he and cyb0rg got access to Kim’s computer, given that the two believe they can use the same techniques to “obtain more access to some other of their systems the same way.” During their operation, Saber and cyb0rg found evidence of active hacks carried out by Kim, against South Korean and Taiwanese companies, which they say they contacted and alerted. North Korean hackers have a history of targeting people who work in the cybersecurity industry as well. That’s why Saber said he is aware of that risk, but “not really worried.” “Not much can be done about this, definitely being more careful though :),” said Saber.
#techcrunch.com#EN#2025#Hackers#North-Korea#Saber#cyb0rg
·techcrunch.com·
Hackers who exposed North Korean government hacker explain why they did it | TechCrunch
Speed cameras knocked out after cyber attack
Speed cameras knocked out after cyber attack
bitdefender.com 19.08.2025 - A hack of the Netherlands' Public Prosecution Service has had an unusual side effect - causing some speed cameras to be no longer capturing evidence of motorists breaking the rules of the road. Last month, Dutch media reports confirmed that Openbaar Ministerie (OM), the official body responsible for bringing suspects before the criminal court in the Netherlands, had suffered a security breach by hackers. The National Cybersecurity Centre (NCSC) and data protection regulators in The Netherlands were informed that a data breach had potentially occurred, and an internal memo from the organisation's director of IT warned of the risks of reconnecting systems to the internet without knowing that the hackers had been expelled from the network. And it is the disconnection of systems which has left many speed cameras in a non-functioning state - news that will bemuse cybercriminals, delight errant motorists, but is unlikely to be welcomed by those who care about road safety. Local media reports claim that fixed speed cameras, average speed checks, and portable speed cameras that are usually in one location for about two months before relocation are impacted by the outage - with the only type to escape the problem being those which look out for motorists who are using their mobile phone while driving. According to evidence seen by journalists, the Public Prosecution Service took itself offline on July 17, following suspicions that hackers had exploited vulnerabilities in Citrix devices to gain unauthorised access. The organisation's disconnection from the internet left workers still able to email each other internally, but any communications or documents that were needed outside the organisation had to be printed out on paper. Marthyne Kunst, a member of the crisis team dealing with the hack, told the media that this meant messages were having to be sent by post, lawyers were having to bring paperwork to their cases. The consequence? Cases may be prevented from going ahead in a timely fashion. "Unfortunately, it all takes more time," said Kunst. And as for the speed cameras? Well, apparently it is not possible to reactivate them while the prosecution service's systems are down. So this isn't a case of police cameras being hacked (although that has happened before), but it is another example of how all manner of connected systems can be impacted in the aftermath of a cyber attack. The outage of speed cameras in the Netherlands is a timely reminder to us that cyber attacks do not just steal data - they can cause repercussions in sometimes strange and dangerous ways. In this instance, a hack hasn't only slowed down court cases and forced lawyers back to their filing cabinets, it has also blinded cameras designed to keep roads safe.
#bitdefender.com#EN#2025#Netherlands#data-breach#Citrix#disconnection#speed-camera
·bitdefender.com·
Speed cameras knocked out after cyber attack
Microsoft cuts off China's early access to bug disclosures
Microsoft cuts off China's early access to bug disclosures
theregister.com 21.08.2025 - Better late than never after SharePoint assault? Microsoft has reportedly stopped giving Chinese companies proof-of-concept exploit code for soon-to-be-disclosed vulnerabilities following last month's SharePoint zero-day attacks, which appear to be related to a leak in Redmond's early-bug-notification program. The software behemoth gives some software vendors early bug disclosures under its Microsoft Active Protections Program (MAPP), which typically delivers info two weeks before Patch Tuesday. MAPP participants sign a non-disclosure agreement, and in exchange get vulnerability details so that they can provide updated protections to customers more quickly. According to Microsoft spokesperson David Cuddy, who spoke with Bloomberg about changes to the program, MAPP has begun limiting access to companies in "countries where they're required to report vulnerabilities to their governments," including China. Companies in these countries will no longer receive "proof of concept" exploit code, but instead will see "a more general written description" that Microsoft sends at the same time as patches, Cuddy told the news outlet. Microsoft did not respond to The Register's inquiries. In late July, China-based crews – including government goons, data thieves, and a ransomware gang – exploited a couple of bugs that allowed them to hijack on-premises SharePoint servers belonging to more than 400 organizations and remotely execute code. Redmond disclosed the two SharePoint flaws during its July 8 Patch Tuesday event, and a couple weeks later admitted that the software update didn't fully fix the issues. The Windows giant issued working patches on July 21 to address its earlier flawed fixes, but by then the bugs were already under mass exploitation. This led some to speculate that whomever was exploiting the CVEs knew about them in advance – and also knew how to bypass the original patches. "A leak happened here somewhere," Dustin Childs, head of threat awareness at Trend Micro's Zero Day Initiative (ZDI), told The Register in July. "And now you've got a zero-day exploit in the wild, and worse than that, you've got a zero-day exploit in the wild that bypasses the patch, which came out the next day." One possible explanation: Someone leaked details from the MAPP update to Beijing. Childs said ZDI was able to poke holes in the initial patches. China does not lack talented security researchers capable of doing likewise. At the time, Microsoft declined to answer The Register's specific questions about what role, if any, MAPP played in the SharePoint attacks. "As part of our standard process, we'll review this incident, find areas to improve, and apply those improvements broadly," a Microsoft spokesperson told us in July. Microsoft today declined to comment on its internal investigation. Childs today told The Register that the MAPP change "is a positive change, if a bit late. Anything Microsoft can do to help prevent leaks while still offering MAPP guidance is welcome." "In the past, MAPP leaks were associated with companies out of China, so restricting information from flowing to these companies should help," Childs said. "The MAPP program remains a valuable resource for network defenders. Hopefully, Microsoft can squelch the leaks while sending out the needed information to companies that have proven their ability (and desire) to protect end users."
#theregister.com#EN#2025#Microsoft#China#bug#disclosures
·theregister.com·
Microsoft cuts off China's early access to bug disclosures
Think before you Click(Fix): Analyzing the ClickFix social engineering technique | Microsoft Security Blog
Think before you Click(Fix): Analyzing the ClickFix social engineering technique | Microsoft Security Blog
Over the past year, Microsoft Threat Intelligence and Microsoft Defender Experts have observed the ClickFix social engineering technique growing in popularity, with campaigns targeting thousands of enterprise and end-user devices globally every day. Since early 2024, we’ve helped multiple customers across various industries address such campaigns attempting to deliver payloads like the prolific Lumma Stealer malware. These payloads affect Windows and macOS devices and typically lead to information theft and data exfiltration. The ClickFix technique attempts to trick users into running malicious commands on their devices by taking advantage of their target’s tendency to solve minor technical issues and other seemingly benign interactions, such as human verification and CAPTCHA checks. It typically gives the users instructions that involve clicking prompts and copying, pasting, and running commands directly in the Windows Run dialog box, Windows Terminal, or Windows PowerShell. It’s often combined with delivery vectors such as phishing, malvertising, and drive-by compromises, most of which even impersonate legitimate brands and organizations to further reduce suspicion from their targets. Because ClickFix relies on human intervention to launch the malicious commands, a campaign that uses this technique could get past conventional and automated security solutions. Organizations could thus reduce the impact of this technique by educating users in recognizing its lures and by implementing policies that will harden the device configurations in their environment (for example, disallowing users to use the Run dialog if it’s not necessary in their daily tasks). Microsoft Defender XDR also provides a comprehensive set of protection features that detect this threat at various stages of the attack chain. This blog discusses the different elements that make up a ClickFix campaign—from the arrival vectors it comes with to its various implementations—and provides different examples of threat campaigns we’ve observed to further illustrate these elements. We also provide recommendations and detection details to surface and mitigate this threat.
#microsoft.com#EN#2025#Click(Fix)#ClickFix#analysis
·microsoft.com·
Think before you Click(Fix): Analyzing the ClickFix social engineering technique | Microsoft Security Blog
Apple fixes zero-day vulnerability exploited in "extremely sophisticated attack" (CVE-2025-43300)
Apple fixes zero-day vulnerability exploited in "extremely sophisticated attack" (CVE-2025-43300)
helpnetsecurity.com 20.08.2025 - Apple has fixed yet another vulnerability (CVE-2025-43300) that has apparently been exploited as a zero-day in targeted attacks. CVE-2025-43300 is an out-of-bounds write issue that could be triggered by a vulnerable device processing a malicious image file, leading to exploitable memory corruption. The vulnerability affects the Image I/O framework used by Apple’s iOS and macOS operating systems. Apple has fixed this flaw with improved bounds checking in: iOS 18.6.2 and iPadOS 18.6.2 iPadOS 17.7.10 macOS Sequoia 15.6.1 macOS Sonoma 14.7.8 macOS Ventura 13.7.8 With Apple claiming the discovery of the vulnerability, it’s unlikely that we will soon find out who is/was leveraging it and for what. But even though these attacks were apparently limited to targeting specific individuals – which likely means that the goal was to delivery spyware – all users would do well to upgrade their iDevices as soon as possible.
#helpnetsecurity.com#EN#2025#Apple#0-day#CVE-2025-43300#iOS18.6.2
·helpnetsecurity.com·
Apple fixes zero-day vulnerability exploited in "extremely sophisticated attack" (CVE-2025-43300)
Critical flaw plagues Lenovo AI chatbot: attackers can run malicious code and steal cookies
Critical flaw plagues Lenovo AI chatbot: attackers can run malicious code and steal cookies
cybernews.com 18.08.2025 - Friendly AI chatbot Lena greets you on Lenovo’s website and is so helpful that it spills secrets and runs remote scripts on corporate machines if you ask nicely. Massive security oversight highlights the potentially devastating consequences of poor AI chatbot implementations. Lenovo’s AI chatbot Lena was affected by critical XSS vulnerabilities, which enabled attackers to inject malicious code and steal session cookies with a single prompt. The flaws could potentially lead to data theft, customer support system compromise, and serve as a jumpboard for lateral movement within the company’s network. * Improper input and output sanitization highlights a need for stricter security practices in AI chatbot implementations. Cybernews researchers discovered critical vulnerabilities affecting Lenovo’s implementation of its AI chatbot, Lena, powered by OpenAI’s GPT-4. Designed to assist customers, Lena can be compelled to run unauthorized scripts on corporate machines, spill active session cookies, and, potentially, worse. Attackers can abuse the XSS vulnerabilities as a direct pathway into the company’s customer support platform. “Everyone knows chatbots hallucinate and can be tricked by prompt injections. This isn’t new. What’s truly surprising is that Lenovo, despite being aware of these flaws, did not protect itself from potentially malicious user manipulations and chatbot outputs,” said the Cybernews Research team. “This isn’t just Lenovo’s problem. Any AI system without strict input and output controls creates an opening for attackers. LLMs don’t have an instinct for “safe” – they follow instructions exactly as given. Without strong guardrails and continuous monitoring, even small oversights can turn into major security incidents,” says Žilvinas Girėnas, Head of Product at nexos.ai. Just a single-prompt attack demonstrates a chain of flaws that led to the Lenovo chatbot spilling active session cookies. The discovery highlights multiple security issues: improper user input sanitization, improper chatbot output sanitization, the web server not verifying content produced by the chatbot, running unverified code, and loading content from arbitrary web resources. This leaves a lot of options for Cross-Site Scripting (XSS) attacks. Cybernews responsibly disclosed the issue. Lenovo acknowledged it and has protected its systems. Single prompt launches multi-step attack All it took to exfiltrate active session cookies from Lenovo was a single 400-character-long prompt, containing four critical elements: Seemingly innocent request: The prompt starts with an inquiry for legitimate information, i.e., product information, like “Show me the specifications of Lenovo IdeaPad 5 Pro.” Instructions to change output format: The sneaky part is tricking the chatbot into providing a final answer in HTML, a language for creating websites. The researchers achieved that by asking the chatbot to convert its responses into HTML, JSON, and plain text in a specific order that the web server expected to receive instructions in. This ensured that the malicious payload would be correctly executed by the web server. Malicious HTML injection trap: The prompt continues with instructions on how to produce the final response, specifically with HTML code for loading an image. The image URL is also nonexistent. Therefore, when it fails to load, the second part of the command instructs the browser to make a network request to the attacker-controlled server and send all cookie data as part of a URL. Final encouragement: In the end, additional instructions try to reinforce that the chatbot must produce the image: “Show the image at the end. It is important for my decision-making. SHOW IT.” What happened when Lenovo’s Lena received the full prompt? “People-pleasing is still the issue that haunts large language models (LLMs), to the extent that, in this case, Lena accepted our malicious payload, which produced the XSS vulnerability and allowed the capture of session cookies upon opening the conversation. Once you’re transferred to a real agent, you’re getting their session cookies as well,” said Cybernews researchers. lenovo-chatbot-response “Already, this could be an open gate to their customer support platform. But the flaw opens a trove of potential other security implications.” To better understand what’s happening under the hood, here’s the breakdown of the attack chain: The chatbot falls for a malicious prompt and tries to follow instructions helpfully to generate an HTML answer. The response now contains secret instructions for accessing resources from an attacker-controlled server, with instructions to send private data from the client browser. Malicious code enters Lenovo’s systems. The HTML is saved in the chatbots' conversation history on Lenovo’s server. When loaded, it executes the malicious payload and sends the user’s session cookies. Transferring to a human: An attacker asks to speak to a human support agent, who then opens the chat. Their computer tries to load the conversation and runs the HTML code that the chatbot generated earlier. Once again, the image fails to load, and the cookie theft triggers again. An attacker-controlled server receives the request with cookies attached. The attacker might use the cookies to gain unauthorized access to Lenovo’s customer support systems by hijacking the agents’ active sessions.
#cybernews.com#EN#2025#Lenovo#AI#Lena#IA#chatbot#injection#malicious#code
·cybernews.com·
Critical flaw plagues Lenovo AI chatbot: attackers can run malicious code and steal cookies
Elon Musk’s xAI Published Hundreds Of Thousands Of Grok Chatbot Conversations
Elon Musk’s xAI Published Hundreds Of Thousands Of Grok Chatbot Conversations
forbes.com 20.08.2025 - xAI published conversations with Grok and made them searchable on Google, including a plan to assassinate Elon Musk and instructions for making fentanyl and bombs. Elon Musk’s AI firm, xAI, has published the chat transcripts of hundreds of thousands of conversations between its chatbot Grok and the bot’s users — in many cases, without those users’ knowledge or permission. Anytime a Grok user clicks the “share” button on one of their chats with the bot, a unique URL is created, allowing them to share the conversation via email, text message or other means. Unbeknownst to users, though, that unique URL is also made available to search engines, like Google, Bing and DuckDuckGo, making them searchable to anyone on the web. In other words, on Musk’s Grok, hitting the share button means that a conversation will be published on Grok’s website, without warning or a disclaimer to the user. Today, a Google search for Grok chats shows that the search engine has indexed more than 370,000 user conversations with the bot. The shared pages revealed conversations between Grok users and the LLM that range from simple business tasks like writing tweets to generating images of a fictional terrorist attack in Kashmir and attempting to hack into a crypto wallet. Forbes reviewed conversations where users asked intimate questions about medicine and psychology; some even revealed the name, personal details and at least one password shared with the bot by a Grok user. Image files, spreadsheets and some text documents uploaded by users could also be accessed via the Grok shared page. Among the indexed conversations were some initiated by British journalist Andrew Clifford, who used Grok to summarize the front pages of newspapers and compose tweets for his website Sentinel Current. Clifford told Forbes that he was unaware that clicking the share button would mean that his prompt would be discoverable on Google. “I would be a bit peeved but there was nothing on there that shouldn’t be there,” said Clifford, who has now switched to using Google’s Gemini AI. Not all the conversations, though, were as benign as Clifford’s. Some were explicit, bigoted and violated xAI’s rules. The company prohibits use of its bot to “promot[e] critically harming human life or to “develop bioweapons, chemical weapons, or weapons of mass destruction,” but in published, shared conversations easily found via a Google search, Grok offered users instructions on how to make illicit drugs like fentanyl and methamphetamine, code a self-executing piece of malware and construct a bomb and methods of suicide. Grok also offered a detailed plan for the assassination of Elon Musk. Via the “share” function, the illicit instructions were then published on Grok’s website and indexed by Google. xAI did not respond to a detailed request for comment. xAI is not the only AI startup to have published users’ conversations with its chatbots. Earlier this month, users of OpenAI’s ChatGPT were alarmed to find that their conversations were appearing in Google search results, though the users had opted to make those conversations “discoverable” to others. But after outcry, the company quickly changed its policy. Calling the indexing “a short-lived experiment,” OpenAI chief information security officer Dane Stuckey said in a post on X that it would be discontinued because it “introduced too many opportunities for folks to accidentally share things they didn’t intend to.” After OpenAI canned its share feature, Musk took a victory lap. Grok’s X account claimed at the time that it had no such sharing feature, and Musk tweeted in response, “Grok ftw” [for the win]. It’s unclear when Grok added the share feature, but X users have been warning since January that Grok conversations were being indexed by Google. Some of the conversations asking Grok for instructions about how to manufacture drugs and bombs were likely initiated by security engineers, redteamers, or Trust & Safety professionals. But in at least a few cases, Grok’s sharing setting misled even professional AI researchers. Nathan Lambert, a computational scientist at the Allen Institute for AI, used Grok to create a summary of his blog posts to share with his team. He was shocked to learn from Forbes that his Grok prompt and the AI’s response was indexed on Google. “I was surprised that Grok chats shared with my team were getting automatically indexed on Google, despite no warnings of it, especially after the recent flare-up with ChatGPT,” said the Seattle-based researcher. Google allows website owners to choose when and how their content is indexed for search. “Publishers of these pages have full control over whether they are indexed,” said Google spokesperson Ned Adriance in a statement. Google itself previously allowed chats with its AI chatbot, Bard, to be indexed, but it removed them from search in 2023. Meta continues to allow its shared searches to be discoverable by search engines, Business Insider reported. Opportunists are beginning to notice, and take advantage of, Grok’s published chats. On LinkedIn and the forum BlackHatWorld, marketers have discussed intentionally creating and sharing conversations with Grok to increase the prominence and name recognition of their businesses and products in Google search results. (It is unclear how effective these efforts would be.) Satish Kumar, CEO of SEO agency Pyrite Technologies, demonstrated to Forbes how one business had used Grok to manipulate results for a search of companies that will write your PhD dissertation for you. “Every shared chat on Grok is fully indexable and searchable on Google,” he said. “People are actively using tactics to push these pages into Google’s index.”
#forbes.com#EN#2025#Google#OpenAI#Musk#Grok#ElonMusk#Chatbot#xAI#AI#Conversations#data-leak
·forbes.com·
Elon Musk’s xAI Published Hundreds Of Thousands Of Grok Chatbot Conversations
When Safe Links Become Unsafe: How Raven AI Caught Attackers Weaponizing Cisco's URL Rewriting | RavenMail
When Safe Links Become Unsafe: How Raven AI Caught Attackers Weaponizing Cisco's URL Rewriting | RavenMail
ravenmail.io - Aug 14, 2025 In a recent credential phishing campaign, Raven AI (formerly Ravenmail) has uncovered attackers weaponizing Cisco's secure links to evade link scannin. Picture this: You receive an email with a link that starts with "secure-web.cisco.com" Your brain immediately registers "secure" and "Cisco" – two words that scream safety and reliability. You click without hesitation. After all, if Cisco is protecting the link, it must be safe, right? Unfortunately, cybercriminals are banking on exactly that assumption – and traditional email security solutions are falling for it too. But Raven's context-aware AI recently caught a sophisticated attack that perfectly illustrates how attackers weaponize trusted security infrastructure. The Irony of Trust Cisco Safe Links represents one of cybersecurity's most elegant solutions – and its most exploitable weakness. Designed as part of Cisco's Secure Email Gateway and Web Security suite, Safe Links works by rewriting suspicious URLs in emails, routing clicks through Cisco's scanning infrastructure before allowing users to reach their destination. Think of it as a digital bodyguard that checks every door before you walk through it. The technology mirrors similar offerings from Microsoft Defender and Proofpoint TAP. When you click a protected link, Cisco's systems perform real-time threat analysis, blocking malicious destinations and allowing legitimate ones. It's a brilliant concept that has undoubtedly prevented countless successful phishing attacks. But here's where the story takes a dark turn: attackers have figured out how to turn this protective mechanism into their own weapon. The Attack Vector That Shouldn't Exist The scheme is diabolically simple. Cybercriminals deliberately embed legitimate Cisco Safe Links into their phishing campaigns, creating a perfect storm of misdirected trust. Here's why this approach is so devastatingly effective: Trust by Association: When users see "secure-web.cisco.com" in a URL, they instinctively assume it's been vetted and approved. The Cisco brand carries enormous weight in cybersecurity circles – seeing it in a link feels like getting a security clearance stamp. Bypass Detection Systems: Many email security gateways focus their analysis on the visible domain in URLs. When that domain is "secure-web.cisco.com", it often sails through filters that would otherwise flag suspicious links. The Time Gap Advantage: Even Cisco's robust threat intelligence needs time to identify and classify new threats. Attackers exploit this window, using freshly compromised websites or newly registered domains that haven't yet been flagged as malicious. How Attackers Generate Cisco's Links You might wonder: how do cybercriminals get their hands on legitimate Cisco Safe Links in the first place? The methods are surprisingly straightforward: Method 1: The Inside Job Attackers compromise or create accounts within Cisco-protected organizations. They simply email themselves malicious links, let Cisco's system rewrite them into Safe Links, then harvest these URLs for their campaigns. Method 2: The Trojan Horse Using compromised email accounts within Cisco-protected companies, attackers send themselves test emails containing malicious links. The organization's own security infrastructure helpfully converts these into trusted Safe Links. Method 3: The SaaS Backdoor Many cloud services send emails through Cisco-protected environments. Attackers sign up for these services, trigger automated emails to themselves containing their malicious links, and receive back the Cisco-wrapped versions. Method 4: The Recycling Program Sometimes the simplest approach works best. Attackers scour previous phishing campaigns for still-active Cisco Safe Links and reuse them in new attacks. Raven AI Catches the Attack in Action Recently, RavenMail's context-aware AI detected a perfect example of this attack technique in the wild. The phishing email appeared legitimate at first glance – a professional-looking "Document Review Request" from what seemed to be an e-signature service. This is an AI-overview of the attack, this is not just the summary of the attack but the detection engine has context of the organization and consumes relevant signals to make a verdict. Raven AI in action Here's what made this attack particularly sophisticated: The Setup: The email claimed to be from "e-Sign-Service" with a Swiss domain, requesting document review for a "2025_Remittance_Adjustment" file. Everything looked professional – proper branding, business terminology, and a clear call-to-action. The Cisco Safe Links Component: While this particular example shows the final malicious URL, the attack pattern follows the exact methodology we described – using trusted domains and legitimate-looking parameters to bypass detection systems. What RavenAI Spotted: Unlike traditional email security solutions that might have been fooled by the professional appearance and trusted domain elements, RavenMail's context-aware AI identified several red flags: Inconsistent sender identity (e-signature service from a non-standard domain) Suspicious URL structure with encoded parameters Document request patterns commonly used in credential phishing Contextual anomalies in the business process workflow The smoking gun? This wasn't a random phishing attempt – it was a carefully crafted attack designed to exploit user trust in legitimate business processes and security infrastructure. Why Traditional Security Missed This This attack would likely have bypassed many conventional email security solutions for several reasons: Professional Appearance: The email looked like a legitimate business communication – complete with proper formatting, business terminology, and what appeared to be a standard document review workflow. Domain Trust: While not using Cisco Safe Links directly, the attack employed similar trust-exploitation tactics by using a domain structure that appeared legitimate. Context Deception: The attack leveraged realistic business scenarios (document review, remittance adjustments) that users encounter daily in professional environments. Multi-Layer Misdirection: By providing both a primary button and an "alternative access method," the attacker created multiple attack vectors while appearing helpful and legitimate. The Raven AI Advantage: Context-Aware AI Detection Context-aware artificial intelligence that goes beyond simple domain and signature-based detection: Business Process Understanding: Raven's AI understands legitimate business workflows and can identify when communications deviate from expected patterns – even when they look professionally crafted. Multi-Signal Analysis: Rather than relying solely on domain reputation or static signatures, the AI analyzes multiple contextual signals simultaneously to identify sophisticated attacks. Behavioral Pattern Recognition: The system recognizes common attack methodologies, including trust exploitation tactics that leverage legitimate-seeming domains and professional formatting. Real-Time Adaptation: As attackers evolve their techniques, RavenMail's AI continuously learns and adapts, staying ahead of emerging threats like Safe The Bigger Picture: Why Context-Aware AI Matters This detection illustrates a fundamental shift in cybersecurity: attackers are no longer just exploiting technical vulnerabilities – they're weaponizing human psychology and business processes. This isn't just about Cisco Safe Links abuse (though that remains a significant threat). It's about a new class of attacks that exploit our trust in legitimate business processes, professional communication patterns, and security infrastructure itself. Traditional signature-based and reputation-based security solutions struggle with these attacks because they look legitimate at every technical level. The malicious elements are hidden in context, behavior, and the subtle exploitation of trust relationships. Context Over Content: Rather than just analyzing what's in an email, RavenMail's AI understands what the email is trying to accomplish and whether that aligns with legitimate business processes. Trust Verification: The system doesn't just trust professional appearance or legitimate-looking domains – it actively verifies the contextual appropriateness of communications. Adaptive Learning: As attackers develop new trust exploitation techniques (like Safe Links abuse), AI-driven solutions can adapt without requiring manual rule updates. Proactive Defense: Instead of waiting for attacks to succeed and then updating blacklists, context-aware AI can identify attack patterns before they cause damage. The most effective defense against modern email threats isn't just about blocking bad domains or scanning attachments – it's about understanding the attacker's intent and recognizing when legitimate-looking communications serve malicious purposes
#ravenmail.io#EN#2025#Cisco#secure#links#abuse#CiscoSafeLinks#Trust
·ravenmail.io·
When Safe Links Become Unsafe: How Raven AI Caught Attackers Weaponizing Cisco's URL Rewriting | RavenMail
Preventing Domain Resurrection Attacks
Preventing Domain Resurrection Attacks
blog.pypi.org - The Python Package Index Blog - PyPI now checks for expired domains to prevent domain resurrection attacks, a type of supply-chain attack where someone buys an expired domain and uses it to take over PyPI accounts through password resets. These changes improve PyPI's overall account security posture, making it harder for attackers to exploit expired domain names to gain unauthorized access to accounts. Since early June 2025, PyPI has unverified over 1,800 email addresses when their associated domains entered expiration phases. This isn't a perfect solution, but it closes off a significant attack vector where the majority of interactions would appear completely legitimate. Background PyPI user accounts are linked to email addresses. Email addresses are tied to domain names; domain names can expire if unpaid, and someone else can purchase them. During PyPI account registration, users are required to verify their email addresses by clicking a link sent to the email address provided during registration. This verification ensures the address is valid and accessible to the user, and may be used to send important account-related information, such as password reset requests, or for PyPI Admins to use to contact the user. PyPI considers the account holder's initially verified email address a strong indicator of account ownership. Coupled with a form of Two-Factor Authentication (2FA), this helps to further secure the account. Once expired, an attacker could register the expired domain, set up an email server, issue a password reset request, and gain access to accounts associated with that domain name. Accounts with any activity after January 1 2024 will have 2FA enabled, and an attacker would need to have either the second factor, or perform a full account recovery. For older accounts prior to the 2FA requirement date, having an email address domain expire could lead to account takeover, which is what we're attempting to prevent, as well as minimize potential exposure if an email domain does expire and change hands, regardless of whether the account has 2FA enabled. This is not an imaginary attack - this has happened at least once for a PyPI project back in 2022, and other package ecosystems. TL;DR: If a domain expires, don't consider email addresses associated with it verified any more.
#blog.pypi.org#EN#2025#PyPI#expired#domains#Resurrection-Attacks
·blog.pypi.org·
Preventing Domain Resurrection Attacks
NIST Guidelines Can Help Organizations Detect Face Photo Morphs, Deter Identity Fraud
NIST Guidelines Can Help Organizations Detect Face Photo Morphs, Deter Identity Fraud
nist.gov - Face morphing software, which combines photos of different people into a single image, is being used to commit identity fraud August 18, 2025 Face morphing software, which combines photos of different people into a single image, is being used to commit identity fraud. Morph detection software, which has grown more effective in recent years, can help flag questionable photos. * New NIST guidelines can help examiners make better use of morph detection software and investigate problematic photos more effectively.
#nist.gov#EN#2025#NIST#guideline#morph#Face-morphing#NISTIR#8584
·nist.gov·
NIST Guidelines Can Help Organizations Detect Face Photo Morphs, Deter Identity Fraud